2022419c3ebb28a926cc3fe58ad23a43e8da551de96fc016655263acd504479a

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 04:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab003105f243230f660502505ea8aade.exe
Size

832KB
MD5

ab003105f243230f660502505ea8aade
SHA1

096d35168c7415223394b451f995437c0b090d0a
SHA256

2022419c3ebb28a926cc3fe58ad23a43e8da551de96fc016655263acd504479a
SHA512

835ea90d7c4eec9ca987c77d62f946f2b7679f447e47ef16279551a69eb93706ced65516f7e15ec3a2124fe3d8915c76e8b03e48562de840e4f363942622524d
SSDEEP

24576:7FLuGD/L5fUJ/nn3bOKSk+gU/FO1GxISS5cWltdzuRhs:z3RUNuzgU01SqXfzuRhs

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2640	DomaIQ10.exe

Loads dropped DLL 1 IoCs

pid	Process
932	ab003105f243230f660502505ea8aade.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 2640	932	ab003105f243230f660502505ea8aade.exe	28
PID 932 wrote to memory of 2640	932	ab003105f243230f660502505ea8aade.exe	28
PID 932 wrote to memory of 2640	932	ab003105f243230f660502505ea8aade.exe	28
PID 932 wrote to memory of 2640	932	ab003105f243230f660502505ea8aade.exe	28

C:\Users\Admin\AppData\Local\Temp\ab003105f243230f660502505ea8aade.exe
"C:\Users\Admin\AppData\Local\Temp\ab003105f243230f660502505ea8aade.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:932
- C:\Users\Admin\AppData\Local\Temp\DIQ\speccy_036\DomaIQ10.exe
  C:\Users\Admin\AppData\Local\Temp\DIQ\speccy_036\DomaIQ10.exe /path="C:\Users\Admin\AppData\Local\Temp\ab003105f243230f660502505ea8aade.exe"
  2⤵
  - Executes dropped EXE
  PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\DIQ\speccy_036\DomaIQ10.exe

Filesize
338KB

MD5
861382e6f15f4f9da374b33df9ffb4f4

SHA1
856bf4263442b696b0baabb873f972d18d420fa7

SHA256
0bd68b800019ecd57bed79320189ea41c62792a92d38b7327de84bdce743d8f8

SHA512
065b6d9da96b33e19e00459bee1006f4388bf881670119b80e15d8428d4bcaafd03873fdfb8ff0ae567919a7b3420359d361a161a712a9810c7105e3896cf205

Download Submit
memory/2640-9-0x00000000002E0000-0x00000000002F0000-memory.dmp

Filesize
64KB

Download
memory/2640-10-0x000007FEF6030000-0x000007FEF69CD000-memory.dmp

Filesize
9.6MB

Download
memory/2640-11-0x00000000020A0000-0x0000000002120000-memory.dmp

Filesize
512KB

Download
memory/2640-12-0x000007FEF6030000-0x000007FEF69CD000-memory.dmp

Filesize
9.6MB

Download
memory/2640-13-0x00000000020A0000-0x0000000002120000-memory.dmp

Filesize
512KB

Download
memory/2640-14-0x00000000020A0000-0x0000000002120000-memory.dmp

Filesize
512KB

Download
memory/2640-15-0x000007FEF6030000-0x000007FEF69CD000-memory.dmp

Filesize
9.6MB

Download