Analysis

  • max time kernel
    93s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/02/2024, 13:24

General

  • Target

    rm2k3-install.exe

  • Size

    29.2MB

  • MD5

    ef0586cb6f4f783f30c9f2a920ccf212

  • SHA1

    b386f0391f2355fa7b32845cf133d3fa4e105a28

  • SHA256

    b37aee201207a0a602d805cc1a5cb5b0c77a0b09a1484f22828d2776376b6495

  • SHA512

    d155e9d6d17a7b92450b761fbe9f6b0c7e5051b56e4941c72e8061c1e5309f23997052ee3169430113b3e11cf79a1f8678d7865fad12332a5fc5e28db6d999c9

  • SSDEEP

    786432:/xpNblY4nsmn2uwMNXFeBThPa7YFuFnEPYmWP9ZEUg:p7O4sm27MN18EFnG01Y

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\rm2k3-install.exe
    "C:\Users\Admin\AppData\Local\Temp\rm2k3-install.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4252
    • C:\Users\Admin\AppData\Local\Temp\INS4873.tmp
      C:\Users\Admin\AppData\Local\Temp\INS4873.tmp /SL3 $801DE C:\Users\Admin\AppData\Local\Temp\rm2k3-install.exe 30583964 30587378 61952
      2⤵
      • Executes dropped EXE
      PID:2988

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\INS4873.tmp

          Filesize

          377KB

          MD5

          ef80f42a048f92263f758f14b09fa30d

          SHA1

          e250058636dee689d6a935d71c0f462e10457239

          SHA256

          a44707ed7ababc6ca81355e9a6afe0e5095d01f1c72ef7b37681447036da518e

          SHA512

          933b43e14cbb734ff48d9b0b06671f15e458633a4e4d52420dd2eda258fc477ae17183a5d83d47da78272d1d6c7f9ba547729cd846ebec5eaf9963b2fce605ed

        • memory/2988-7-0x00000000022F0000-0x00000000022F1000-memory.dmp

          Filesize

          4KB

        • memory/2988-9-0x0000000000400000-0x000000000046A000-memory.dmp

          Filesize

          424KB

        • memory/2988-13-0x00000000022F0000-0x00000000022F1000-memory.dmp

          Filesize

          4KB

        • memory/2988-24-0x0000000000400000-0x000000000046A000-memory.dmp

          Filesize

          424KB

        • memory/2988-27-0x0000000000400000-0x000000000046A000-memory.dmp

          Filesize

          424KB

        • memory/4252-8-0x0000000000400000-0x0000000000417000-memory.dmp

          Filesize

          92KB

        • memory/4252-28-0x0000000000400000-0x0000000000417000-memory.dmp

          Filesize

          92KB