Analysis

  • max time kernel
    27s
  • max time network
    22s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    02-03-2024 23:32

General

  • Target

    Trojan/13reset/13reset.exe

  • Size

    74KB

  • MD5

    105c40b6c9b169d401eae3c243aa64c3

  • SHA1

    702f9b235603412c71a3f727e9d42d29a34b4eaf

  • SHA256

    d96400bbe3840a92dbd3d2ee7663a13419bda70a3f49979206cd09f2c5986d79

  • SHA512

    7c352c6a7dc4321313e087df46835e7d2f2fffe0bdb8787ef196b37711b3f95f701b3b0b1ccf92f616161b61b2d2890c0b8351f97ce8061ac856fa776ef09dfc

  • SSDEEP

    1536:w64fj+783T7pfXoD+gt6hdHRCeq8CT7QfXoD+gt6hdHRCi:1wj+783TF/ovMjHjq8CTk/ovMjHJ

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe
    "C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2620
    • C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe
      "C:\Users\Admin\AppData\Local\Temp\Trojan\13reset\13reset-helper.exe"
      2⤵
        PID:2736

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2620-0-0x0000000000990000-0x00000000009A8000-memory.dmp

      Filesize

      96KB

    • memory/2620-1-0x0000000074D00000-0x00000000753EE000-memory.dmp

      Filesize

      6.9MB

    • memory/2620-2-0x0000000004990000-0x00000000049D0000-memory.dmp

      Filesize

      256KB