e90820e973087afb8a4f8b23b73d07f7c63a059e0faea498058bcb2fe17cb90d

Analysis

max time kernel
13s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 03:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b589ee67c0bdb784e379e47fdd51d2c1.exe
Size

31KB
MD5

b589ee67c0bdb784e379e47fdd51d2c1
SHA1

f8cff433de4a25dbbb38830a0c0c3d6edaf00ad6
SHA256

e90820e973087afb8a4f8b23b73d07f7c63a059e0faea498058bcb2fe17cb90d
SHA512

281cd100fdfbe3a04845ecfe0c177daf80ce7134778516625ff231aa1b300e167d3c4a94ade5843c71ff27de3a87b206c0bd455a7d2692d400b4cca2cdacbdad
SSDEEP

384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSzn8YtRQM:b/yC4GyNM01GuQMNXw2PSjXZ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2532	retln.exe

Loads dropped DLL 1 IoCs

pid	Process
2112	b589ee67c0bdb784e379e47fdd51d2c1.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2112	b589ee67c0bdb784e379e47fdd51d2c1.exe
2532	retln.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2532	2112	b589ee67c0bdb784e379e47fdd51d2c1.exe	28
PID 2112 wrote to memory of 2532	2112	b589ee67c0bdb784e379e47fdd51d2c1.exe	28
PID 2112 wrote to memory of 2532	2112	b589ee67c0bdb784e379e47fdd51d2c1.exe	28
PID 2112 wrote to memory of 2532	2112	b589ee67c0bdb784e379e47fdd51d2c1.exe	28

C:\Users\Admin\AppData\Local\Temp\b589ee67c0bdb784e379e47fdd51d2c1.exe
"C:\Users\Admin\AppData\Local\Temp\b589ee67c0bdb784e379e47fdd51d2c1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Users\Admin\AppData\Local\Temp\retln.exe
  "C:\Users\Admin\AppData\Local\Temp\retln.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
31KB

MD5
b229091cfa379cd0743ce2e10219fafc

SHA1
3a2d0a600a5da49dd5a15d3e921e81cbe90e88c0

SHA256
1272912da33f641863d1fcd9fe5a9a706a99fae2458a8bb76f65a2567ea4fa53

SHA512
57abf31fbb70d2f6edb3b4db85efdf8c39d3795731a67504acddab85020d0d5cfeafaa136f9b1a6d83f02d55c9ed6dd940e5b86461332183150bae736f34824b

Download Submit
memory/2112-0-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/2112-2-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/2112-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2532-16-0x0000000000260000-0x0000000000266000-memory.dmp

Filesize
24KB

Download