5dc778d07d3c34392721fc6cfbec22726b9fd0ec36d3ad6850ed6a3879f1bd08

Analysis

max time kernel
147s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
08-03-2024 03:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba6461158c7393f00528bd2e578d3d1f.exe
Size

76KB
MD5

ba6461158c7393f00528bd2e578d3d1f
SHA1

a1326f2472ee8f8fb2114056b19157ed515196c2
SHA256

5dc778d07d3c34392721fc6cfbec22726b9fd0ec36d3ad6850ed6a3879f1bd08
SHA512

ca1c037bd6457c405634f3dee20bc88021ad5ecf67d5d4af2f60fe738a46c073e10d322ec1ff01e9e8e4ffbaef72ff9519efd89c9f900192c35c2f578bd46f75
SSDEEP

1536:6lNVA9Hj4ccj983nobVj+IG2GQ+jQ+inPEy/ibo0:qNVA9HNk83obVYMPEy/ct

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ielus.lnk	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2192	ba6461158c7393f00528bd2e578d3d1f.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2288	2192	ba6461158c7393f00528bd2e578d3d1f.exe	28
PID 2192 wrote to memory of 2288	2192	ba6461158c7393f00528bd2e578d3d1f.exe	28
PID 2192 wrote to memory of 2288	2192	ba6461158c7393f00528bd2e578d3d1f.exe	28
PID 2192 wrote to memory of 2288	2192	ba6461158c7393f00528bd2e578d3d1f.exe	28

C:\Users\Admin\AppData\Local\Temp\ba6461158c7393f00528bd2e578d3d1f.exe
"C:\Users\Admin\AppData\Local\Temp\ba6461158c7393f00528bd2e578d3d1f.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cntxy.vbs"
  2⤵
  - Drops startup file
  PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cntxy.vbs

Filesize
5KB

MD5
bdab944edf5daa41078c2c8c39f5340b

SHA1
2c806bf8029dc90c246b7ee92cbe338f565e7a4d

SHA256
bf524e7723b923a4bcba6ebafe3bb0fbde9b367b09dd6486eea17ec23ca4ba9d

SHA512
75aa967444703db900da29c980ef48d9d604f005fa3a3e9c6896e286726d51c9324443453f96d8d54b4aad7d70aa74d23298cb0b009a40a7a6f43f08a085e8fe

Download Submit
memory/2192-3-0x0000000000250000-0x0000000000269000-memory.dmp

Filesize
100KB

Download
memory/2192-4-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2192-2-0x0000000000240000-0x000000000024A000-memory.dmp

Filesize
40KB

Download