35bcbe83559ef07628aeb933f9c556b3a091ac996fb35508a482e3cd367d6a18

Analysis

max time kernel
142s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 13:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cool-3gp-converter-gb.exe
Size 5.4MB
Sample240228-qlrayace5w
SHA256 2dd8ab6eeb9b1da1ffe24d763f3283a69915d99b9e99d63f4214bcab2694aaa0
MD5 e73abbe223d122136c1042818ea3e7da
SHA1 de162d707530813007667fc432a55760bf8cac9b
SHA512 1113d9bd6685aaa59fc879cc63b3cb828516c7b9275082e37b6534a4bc39fd78f7c9d3e072a358d299436e100ace73cf49c5bb34ea4a51c9704169599f4222a2
SSDEEP 98304:/LckRG2E5JsqnEyWAN5wiloBNhgI4qco5OhFEKgjHnk3iBITDyTVqxEksUahGQIa:/LckRNQJVbYv4qN5OvEnjHOiCH65UsGg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4688	cool-3gp-converter-gb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\cool-3gp-converter-gb.exe
"C:\Users\Admin\AppData\Local\Temp\cool-3gp-converter-gb.exe"
1⤵
- Loads dropped DLL
PID:4688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz432.tmp\InstallOptions.dll
Size 14KB
SHA256 44c822afaa4cc7cb95390eaa0ada076d280d3455870569f0cde03637257d9899
MD5 0285eac59530ff5cc91fe2634b4ed78e
SHA1 241c12aefca0740e776362f30aa1edffd66d6bdc
SHA512 1007fbfb82d4e6c04bd5fefb32cd81f4406022ceef4d409eda0f0ddeb8b1f124a2baec86498bc119778e0c241fc41b0c2440d8a8f6731a63ede936be94f81297
SSDEEP 192:8nK6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+MTgK72dwF7dBEnbok:8K6UdHXcIiY535zBtMTg+BEnbo
MD5 SHA1 SHA512 SSDEEP

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsz432.tmp\ioSpecial.ini
Size 598B
SHA256 b6748623736de1418244cc1884d2f52d858b8e3d68f3f77d8a19a27acb3db548
MD5 7b671abd1030129f047177ac11071166
SHA1 5428a9c3de688279dabb617bbf2fa393a04c0278
SHA512 8b1f58d0f842576dc43385819f15ec3e00c796fb30ad71695ff948a26653a3c41965d0f1a01808e3a50b23b3d6cc5672a315f958a9df1710e31cc0379db66d99
MD5 SHA1 SHA512