cf79daaa640a2276784492a9e99c7ca40f4bed9c42e917185a7eb155c414af11

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf79daaa640a2276784492a9e99c7ca40f4bed9c42e917185a7eb155c414af11.exe
Size

39KB
MD5

2af63dd437a1253d6d52e23c757b8791
SHA1

c2ab1be507cd2575456fbd761cfa65f4d283d6d8
SHA256

cf79daaa640a2276784492a9e99c7ca40f4bed9c42e917185a7eb155c414af11
SHA512

fbc41beb0a1af47af1c78206ee12451f2be6b7d3975ff943e2a1f7cae3aa019e2cf56417ca866ae5eea713410f769c57336b27c64b3788363d2d688f8c581059
SSDEEP

384:0K5kypvP/fm5iySkMP+OijkOj0tOcOYWO6O9Ock8szTDhCU/xLI3BZnthyWoPxIK:0KntXyDOo26TDhCU/xLQBZnK5Z7Jag

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3040	saloon.exe

Loads dropped DLL 2 IoCs

pid	Process
2156	cf79daaa640a2276784492a9e99c7ca40f4bed9c42e917185a7eb155c414af11.exe
2156	cf79daaa640a2276784492a9e99c7ca40f4bed9c42e917185a7eb155c414af11.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 3040	2156	cf79daaa640a2276784492a9e99c7ca40f4bed9c42e917185a7eb155c414af11.exe	28
PID 2156 wrote to memory of 3040	2156	cf79daaa640a2276784492a9e99c7ca40f4bed9c42e917185a7eb155c414af11.exe	28
PID 2156 wrote to memory of 3040	2156	cf79daaa640a2276784492a9e99c7ca40f4bed9c42e917185a7eb155c414af11.exe	28
PID 2156 wrote to memory of 3040	2156	cf79daaa640a2276784492a9e99c7ca40f4bed9c42e917185a7eb155c414af11.exe	28

C:\Users\Admin\AppData\Local\Temp\cf79daaa640a2276784492a9e99c7ca40f4bed9c42e917185a7eb155c414af11.exe
"C:\Users\Admin\AppData\Local\Temp\cf79daaa640a2276784492a9e99c7ca40f4bed9c42e917185a7eb155c414af11.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Users\Admin\AppData\Local\Temp\saloon.exe
  "C:\Users\Admin\AppData\Local\Temp\saloon.exe"
  2⤵
  - Executes dropped EXE
  PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\saloon.exe

Filesize
40KB

MD5
b2bff5c437c16afd2458e9da1a4d5676

SHA1
3f54787e8cb617e8f0d0bc37739c44d547fe2bc2

SHA256
226977344f6e1547d23487b946b68befe7ee02f9b4e91979acd58f77875137ca

SHA512
b4e400ed7ebfe0640ef888ec0b6ffbd89f9fa4d3e8571a347d419a829e504963ace699712bad69a849f01670c86a3c5ea311a7c67cb75118399d8539b8812fb4

Download Submit
memory/2156-1-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3040-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download