325cd8cd74165c89739dc34ef141db4dcbbe849fbf63b952bd13f080e8506f8f

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 13:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ADR_Install_2.26 Build 118.exe
Size

2.2MB
MD5

df1aaddd7c0889fde5c720b7c590ea60
SHA1

7cb8d0ad0eec83c411401bc70945bc50882bdc93
SHA256

475b272a4cd0183b1fad4ef762faf2c25a586f38d33da324eb26a19c7073640c
SHA512

c78f98095cb9c4ed3cd25fd314c59be7cba7d7ea3d185f9fd629ec9b9ed063d3481b39d453895f7439eb63591eeb43907d4123d6a8957f262c18e381871ea992
SSDEEP

49152:DaBcX/yLfliUwUfuy0LW/jRQCDDKswXfmPX9/8mPhrFMOhvZksH5:/XafpdjRQCDesfXZ8yZFZZpH5

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2084	ADR_Install_2.26 Build 118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\ADR_Install_2.26 Build 118.exe
"C:\Users\Admin\AppData\Local\Temp\ADR_Install_2.26 Build 118.exe"
1⤵
- Loads dropped DLL
PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsdF2E.tmp\LangDLL.dll

Filesize
5KB

MD5
c9ac0758ce8c10793d39655064c653cb

SHA1
8ba1f9dfcc671b5102f5940da67570c28252bc71

SHA256
161d69c50e5c50d853fda129b6f6f6bc241214b87d13a33bf93543e7e6886119

SHA512
54a8c2ded9a42de867c8a89a11701bcdb5d51aea168c4f3ffe8991859cf26f15d478b6111c85732c1059edbfd9408e42ca830706347a8ac87c5064e47d823349

Download Submit