b141e551b4679e1980c2a717f4d7494540b7f9bc4b96f127339502977e38807d

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 00:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b141e551b4679e1980c2a717f4d7494540b7f9bc4b96f127339502977e38807d.exe
Size

58KB
MD5

4a1268e8148c2bf5e7ef131067dec257
SHA1

a4e3e5b139981137385bf07187b151d1cbfded73
SHA256

b141e551b4679e1980c2a717f4d7494540b7f9bc4b96f127339502977e38807d
SHA512

f53057234fa9455a65e9ad4353bb32ea94432a129b5d7cd8b22d6d49211c53c610af25a3a642fc438622970496f20ecbf9153bb7c6ecaecd0889f80d72aa59ba
SSDEEP

1536:35H5545555555555555555555Au5555555555555555Fq555555555555555555D:/+jUQQQtUn

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3060	nmiya.exe

Loads dropped DLL 2 IoCs

pid	Process
2356	b141e551b4679e1980c2a717f4d7494540b7f9bc4b96f127339502977e38807d.exe
2356	b141e551b4679e1980c2a717f4d7494540b7f9bc4b96f127339502977e38807d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 3060	2356	b141e551b4679e1980c2a717f4d7494540b7f9bc4b96f127339502977e38807d.exe	29
PID 2356 wrote to memory of 3060	2356	b141e551b4679e1980c2a717f4d7494540b7f9bc4b96f127339502977e38807d.exe	29
PID 2356 wrote to memory of 3060	2356	b141e551b4679e1980c2a717f4d7494540b7f9bc4b96f127339502977e38807d.exe	29
PID 2356 wrote to memory of 3060	2356	b141e551b4679e1980c2a717f4d7494540b7f9bc4b96f127339502977e38807d.exe	29

C:\Users\Admin\AppData\Local\Temp\b141e551b4679e1980c2a717f4d7494540b7f9bc4b96f127339502977e38807d.exe
"C:\Users\Admin\AppData\Local\Temp\b141e551b4679e1980c2a717f4d7494540b7f9bc4b96f127339502977e38807d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Users\Admin\AppData\Local\Temp\nmiya.exe
  "C:\Users\Admin\AppData\Local\Temp\nmiya.exe"
  2⤵
  - Executes dropped EXE
  PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nmiya.exe

Filesize
58KB

MD5
82fbcf47ba85e53375caa70b6755dde3

SHA1
c6ea71247e2303c7fc107b5494fbaac0fc41d8cf

SHA256
9738c3168361ff3261a2cccbdb8cf1dfe38229013ba370fa2fc5bf9c1ae23fd5

SHA512
af19a13d1d9443ca30ec2d21d6be420ae38e50ab802092488f238fe3926a6b17337f4595981c438317eabca78994ae09833d42d239205b77624dbc2ee7571dfb

Download Submit
memory/2356-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2356-2-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2356-12-0x00000000033D0000-0x00000000033E5000-memory.dmp

Filesize
84KB

Download
memory/3060-13-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3060-15-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download