e72c8232da3905ae345cdf13678b6ab2ebdd0c07fa96b96c5e82f7717d136dde

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 08:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c569c1336c232ca5367f18d1474112d4.exe
Size 372KB
Sample240313-j828dsae32
SHA256 e72c8232da3905ae345cdf13678b6ab2ebdd0c07fa96b96c5e82f7717d136dde
MD5 c569c1336c232ca5367f18d1474112d4
SHA1 5eb05452bc4f7dfc666721181f846c9325c64310
SHA512 a1157b1f95daa36605f300f432bfc33edd6258e5d04ad05aa25175e025799d27e282b9fcae65110a1ee3f946eb4ec3e1a2cf7094f936d4ebff83819c2f289d8f
SSDEEP 6144:x1T977tTotW/RV3tzPwhXVG3+PkjhZW2HEBj3g13g0PO/kzzGRTSYJC3zBRJw7/C:jThNotW5htzPgVlIZHEBj3YQk2VSvBRy
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5028	setup.exe
3948	loader.exe

Loads dropped DLL 2 IoCs

pid	Process
5028	setup.exe
5028	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 5028	1380	c569c1336c232ca5367f18d1474112d4.exe	87
PID 1380 wrote to memory of 5028	1380	c569c1336c232ca5367f18d1474112d4.exe	87
PID 1380 wrote to memory of 5028	1380	c569c1336c232ca5367f18d1474112d4.exe	87
PID 1380 wrote to memory of 3948	1380	c569c1336c232ca5367f18d1474112d4.exe	89
PID 1380 wrote to memory of 3948	1380	c569c1336c232ca5367f18d1474112d4.exe	89
PID 1380 wrote to memory of 3948	1380	c569c1336c232ca5367f18d1474112d4.exe	89

C:\Users\Admin\AppData\Local\Temp\c569c1336c232ca5367f18d1474112d4.exe
"C:\Users\Admin\AppData\Local\Temp\c569c1336c232ca5367f18d1474112d4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Users\Admin\AppData\Local\Temp\73D8\setup.exe
  C:\Users\Admin\AppData\Local\Temp\73D8\setup.exe 00010400
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5028
- C:\Users\Admin\AppData\Local\Temp\73D8\loader.exe
  C:\Users\Admin\AppData\Local\Temp\73D8\loader.exe
  2⤵
  - Executes dropped EXE
  PID:3948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cnprovh.dll

Path C:\Users\Admin\AppData\Local\Temp\73D8\cnprovh.dll
Size 72KB
SHA256 f2f89bedc3a84fd261910c96d07219985db61f2e7d23bbe52cab034e3b52dd28
MD5 3d8a11f1dc9127afc415a3c5aa0f4ab8
SHA1 fd0773db131ed9ab5a366e0a99a811d4fdd683cd
SHA512 19dfbb2542335fa10e5f151143a414623d780105ee424f2a1245f5ade5b71fded7c2559b35f7acb4bb2c76acb70ba2b3f46c97812241c9b5297de2416e4aab3e
SSDEEP 768:P1TdEhNOsPFpHREP7YMftxhHnXTv7d1A52FyB4uofVZJEdoj6pofYOerjM:P1TdO8sNL8fnXTTd1AR+5ZJv2ofzerA
MD5 SHA1 SHA512 SSDEEP

Submit Download

cuscfg.dat

Path C:\Users\Admin\AppData\Local\Temp\73D8\cuscfg.dat
Size 144B
SHA256 cb03c9b871dddabcf2acaf881086f315aeaac78eb4c63c2f3bd1d9554ea67cd0
MD5 8acafc59e1f7fe1949c30eba557de264
SHA1 e0aca114f063825f4d53dd332d84b84bd41616cd
SHA512 4632ee8c1ce9ea6b6e1785e5ebff7a6bd618e5fb7eceb99b0e18bc16a7f23befcca8d8bf08adc1ec7b461bb99418b070f246fe9897b8ef4ad9ba5f9a2a9dbb36
MD5 SHA1 SHA512

Submit Download

loader.exe

Path C:\Users\Admin\AppData\Local\Temp\73D8\loader.exe
Size 104KB
SHA256 3f29dd5ec4cc26eeabee3cfb0c5f9e7db30fc26840004e5c0c640159af80149a
MD5 c8d32d9ce600888693ccb1864bf6bdd2
SHA1 6c2502e847fb3af8e3a175c9d1e4fe3ca547fbc4
SHA512 9d5657e5966cc86eb47e206256d89723b753cc6975393a5c107d98571466684f4526e7266f8eabc547aa72eb838ef133ca2b828eca7dadca0141a6772d9ab34f
SSDEEP 1536:wWX4sOn+nJKou+KcJln3YCpgf1XJxVuv:Fosk+nJKo4qln3Np81XJxIv
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.dll

Path C:\Users\Admin\AppData\Local\Temp\73D8\setup.dll
Size 92KB
SHA256 a656e0ca7ea70169614f7967d90934278d0c7285bd6fe77758c7eb82fc2d9e93
MD5 7afb1830e0152c1045a797c9a1891206
SHA1 c65f1bb7df75141161d1f50ea057cd4a5862f830
SHA512 6e316b59322fadea23e24fea86677fa5089fb8532320df476d67cb2e85d055cf25246a74fcfce9c8cc0d126ca63ea6a7c4dc16eb1da29d1e3c6316c74a3be69e
SSDEEP 1536:4WrSZhGPDHFZmH1Eu61b7enuiYleyFfxzP+vKzZzLzuWhw:maPqVcb7wYleWaKzZzLzu
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\73D8\setup.exe
Size 28KB
SHA256 7b8fa22c5f80b10ddb5fd7932c402d78e24751ce9b86af2df65530f576572297
MD5 a4bf929fdcb401b8cfd9fd212686907e
SHA1 0dc1a0e285c94dd4ec57cc7e72ef1623d83c0abb
SHA512 5ee0256db29b77fc96267d83580863a9082fbc735fcd63b5a1fef4d43699d6a1b8727633f79205d2e58298da7d9bcfffab61f599e698c9d1408667b615f015fa
SSDEEP 192:MwA1l9mL0oiF5xFF1fShA2JANT+rQXn++jrMxywUmZBdZD57uwxYo5inBhMSQVbe:MwAYu5FwpTnUmlHleMvyygr7ZrhwoW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1380-0-0x0000000000400000-0x0000000000566000-memory.dmp

Download

memory/1380-36-0x0000000000400000-0x0000000000566000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads