020869dd355c2d240e475f44ac0fc85e56d322cab0551954fcb0e8bb3dd8c691

Analysis

max time kernel
122s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 17:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

020869dd355c2d240e475f44ac0fc85e56d322cab0551954fcb0e8bb3dd8c691.exe
Size

172KB
MD5

55fe4269ddc8534733e9797a879c5d96
SHA1

26c4d6915c452c38d90e1eebf79c07c8c8c3e9e9
SHA256

020869dd355c2d240e475f44ac0fc85e56d322cab0551954fcb0e8bb3dd8c691
SHA512

56ab05011725de2ac31c411813d801cab3f43edaf946e85d205c9b685f72dcc636946663a43c0a7a9f69c9fe4284a00c5af4d4c14d3d8b135a3582acf93243a6
SSDEEP

3072:vYfuVGYJYN5XRu39qWq+5EXzBbRDtgTjcFgHnqfqeg8pAwyy3PZYU:kD03EWaV1SbqsaAwyy+U

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3012	ins9531.exe

Loads dropped DLL 4 IoCs

pid	Process
2356	020869dd355c2d240e475f44ac0fc85e56d322cab0551954fcb0e8bb3dd8c691.exe
2356	020869dd355c2d240e475f44ac0fc85e56d322cab0551954fcb0e8bb3dd8c691.exe
2356	020869dd355c2d240e475f44ac0fc85e56d322cab0551954fcb0e8bb3dd8c691.exe
2356	020869dd355c2d240e475f44ac0fc85e56d322cab0551954fcb0e8bb3dd8c691.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3012	ins9531.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3012	ins9531.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3012	ins9531.exe
3012	ins9531.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 3012	2356	020869dd355c2d240e475f44ac0fc85e56d322cab0551954fcb0e8bb3dd8c691.exe	28
PID 2356 wrote to memory of 3012	2356	020869dd355c2d240e475f44ac0fc85e56d322cab0551954fcb0e8bb3dd8c691.exe	28
PID 2356 wrote to memory of 3012	2356	020869dd355c2d240e475f44ac0fc85e56d322cab0551954fcb0e8bb3dd8c691.exe	28
PID 2356 wrote to memory of 3012	2356	020869dd355c2d240e475f44ac0fc85e56d322cab0551954fcb0e8bb3dd8c691.exe	28

C:\Users\Admin\AppData\Local\Temp\020869dd355c2d240e475f44ac0fc85e56d322cab0551954fcb0e8bb3dd8c691.exe
"C:\Users\Admin\AppData\Local\Temp\020869dd355c2d240e475f44ac0fc85e56d322cab0551954fcb0e8bb3dd8c691.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Users\Admin\AppData\Local\Temp\n9531\ins9531.exe
  "C:\Users\Admin\AppData\Local\Temp\n9531\ins9531.exe" ins.exe /e11736493 /u51938065-e47c-4b97-bfda-2a105bc06f2f
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\n9531\ins9531.exe

Filesize
201KB

MD5
895cb5ab5ffb2f8dde5e3cdc7a84bffc

SHA1
6509bb946f976e49521c8e317b95b47d3bfa584f

SHA256
44dc4038b14a188209acabbdf44cce73b5aabd7b4ea27d643e3231ec91f2090d

SHA512
59cdfd532a5b4c28cea981949e2a8155de36a4dde5c6f847e04ba5a5d3cd46e85872c461f23f1afdf015616a317ea2a8432dafed0a8680080f43ca9d0f42d21b

Download Submit
memory/2356-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2356-3-0x0000000000530000-0x0000000000540000-memory.dmp

Filesize
64KB

Download
memory/2356-26-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2356-24-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3012-19-0x000007FEF5750000-0x000007FEF60ED000-memory.dmp

Filesize
9.6MB

Download
memory/3012-18-0x0000000000AC0000-0x0000000000B40000-memory.dmp

Filesize
512KB

Download
memory/3012-20-0x0000000000AC0000-0x0000000000B40000-memory.dmp

Filesize
512KB

Download
memory/3012-21-0x0000000000AC0000-0x0000000000B40000-memory.dmp

Filesize
512KB

Download
memory/3012-22-0x0000000000AC0000-0x0000000000B40000-memory.dmp

Filesize
512KB

Download
memory/3012-23-0x0000000000AC0000-0x0000000000B40000-memory.dmp

Filesize
512KB

Download
memory/3012-17-0x000007FEF5750000-0x000007FEF60ED000-memory.dmp

Filesize
9.6MB

Download
memory/3012-25-0x000007FEF5750000-0x000007FEF60ED000-memory.dmp

Filesize
9.6MB

Download
memory/3012-16-0x00000000003F0000-0x00000000003FA000-memory.dmp

Filesize
40KB

Download