6fcb8d0691e96a632457965acfac5d5434b0e1551acd6a6d650b14fcdffba1c8

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 17:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ac7654758d1ff436196f3b0cef1ea4d5.exe
Size 371KB
Sample240228-v71hysaa2s
SHA256 6fcb8d0691e96a632457965acfac5d5434b0e1551acd6a6d650b14fcdffba1c8
MD5 ac7654758d1ff436196f3b0cef1ea4d5
SHA1 3119232f8bb1dea13051d96beda8d5274fff9c2c
SHA512 fe8317f2fa5165fbf253522c0b1ba4eb787f8b4714a00d9098cc7e3e92c8ceecdd38a583f82e30941d070d7732df03a3531a8e101704deb7f9562754327da16a
SSDEEP 6144:TGKdoUGohlFoYS05EC+nqfJRBRmoeqZ/dIHDZtcgAXPmq0ZtaF:ThS2hljS05ECUqfHBRmoPFIHNtcd/
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2376	setup.exe

Loads dropped DLL 3 IoCs

pid	Process
2376	setup.exe
2376	setup.exe
2376	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 2376	4060	ac7654758d1ff436196f3b0cef1ea4d5.exe	90
PID 4060 wrote to memory of 2376	4060	ac7654758d1ff436196f3b0cef1ea4d5.exe	90
PID 4060 wrote to memory of 2376	4060	ac7654758d1ff436196f3b0cef1ea4d5.exe	90

C:\Users\Admin\AppData\Local\Temp\ac7654758d1ff436196f3b0cef1ea4d5.exe
"C:\Users\Admin\AppData\Local\Temp\ac7654758d1ff436196f3b0cef1ea4d5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Users\Admin\AppData\Local\Temp\346E\setup.exe
  C:\Users\Admin\AppData\Local\Temp\346E\setup.exe 00010802
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cdnins.dll

Path C:\Users\Admin\AppData\Local\Temp\346E\cdnins.dll
Size 84KB
SHA256 338241694a74dd0297a5c31f4c1ea320236c8948b3dac7daab7d901387897033
MD5 73db7fbd3f2b08ae4998b062bbff6550
SHA1 c4ba72e66d252fafae1c744d7e3c5680dd0e6f42
SHA512 a23a8e0253de31e262d5e0c8e3577831494bce8aeb159979a70cfc23aff0def2368c6d151fbb04566c5b17b29356242b978c3a06190b02e2fd6b388b05aa5819
SSDEEP 1536:RPGr/hFTc3zh30WwXSORcr7jLW2wcxEEkr72sNgfSzP+vNe4m:szTcjh3+XSOqkcxEEkrNSvN0
MD5 SHA1 SHA512 SSDEEP

Submit Download

cdnprh.dll

Path C:\Users\Admin\AppData\Local\Temp\346E\cdnprh.dll
Size 48KB
SHA256 d2cbaa05a5118f6232c2ea63846c7a29322c4c2e13104df951acb306f7c6c40c
MD5 ade4842ac4671e94d53f1f3f35e9c801
SHA1 c947f535880fbeab2bcc03b5063326369077b8c3
SHA512 1d41fff2ad0b16201512c4919c1f781887044322ef0f6de4d686c7984bbc6820ff565b86e298fd5a46c4f8b23bc930c4ce59c1ac44d2337f2ac6fe44363d922c
SSDEEP 768:njMYqfTZ/ByTtAQEhDFpJwEB8pwSnQ4ojS43:njMYqbZATtAQEpCEMzxojSG
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\346E\setup.exe
Size 28KB
SHA256 c04c7fc192dafae211fef79ba0036cfc32d4c7a812bdedfbf929489a5e6413fd
MD5 7e056987950898030c27497069d3872f
SHA1 fe1bb487b4d4ff4e42d5471ef1f3436864e86f0a
SHA512 427e82c5338e9d0f43e372406aee7b2d569cf0af2834199d977e6b060ad5c73bbcc939c67af0654e7bbf3ec965d109f9528d35dd11eae26df2e12bf06d953344
SSDEEP 384:ElvXHstNu59QxdUmlH+GyywiejwSoEFlJxO:ge+KdvyJiej/FFlzO
MD5 SHA1 SHA512 SSDEEP

Submit Download

src.dat

Path C:\Users\Admin\AppData\Local\Temp\346E\src.dat
Size 143B
SHA256 2af0de725987ab02829fdbf19cb98664d358bf1dc92b561fbd85ca69a5df19a1
MD5 bfe62e522c4f2e0da2a21822692be13a
SHA1 4baa2ba90d2f5a688436f25b3023ffcd8521a8e7
SHA512 d0e156a3d2018e4e6c73958a5b413c8697b05a5ee125efab5428705f2054468c8a8b3c3126c5be6ee962dd74da0480e0e20758d2d65f17ecb07ca383069fe330
MD5 SHA1 SHA512

Submit Download

memory/4060-0-0x0000000000400000-0x0000000000505000-memory.dmp

Download

memory/4060-26-0x0000000000400000-0x0000000000505000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads