Overview

overview

8

Static

static

3

10a63fb12b...e6.exe

windows7-x64

7

10a63fb12b...e6.exe

windows10-2004-x64

7

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

Evase.ps1

windows7-x64

8

Evase.ps1

windows10-2004-x64

8

Analysis

  • max time kernel
    117s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    16/03/2024, 02:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    10a63fb12bcb5c72c8effdb907ecf4c5aceb8e4bf8808bac6465f9465f43a2e6.exe

  • Size

    356KB

  • MD5

    2ce9926c9f6a60f0ce753bf7919261bf

  • SHA1

    c68a3d5d6f97fe0e9c6686252683086671de5b42

  • SHA256

    10a63fb12bcb5c72c8effdb907ecf4c5aceb8e4bf8808bac6465f9465f43a2e6

  • SHA512

    d040c2096c2fbd663471c7dd3cf2116888c57905b8422ce11c9bc32c9939b666890a1b068a6998b93c1fe90eca6e3d6ce3c49e740fd65adead9ad2caf1ecccb1

  • SSDEEP

    6144:foGzI1XpCBwJxO6miqt1Tu4hn6RyIhiYn8W2YBptQY74exJPWta:fbSCBwLO6BqtFn6ROo8W5ztQA42Psa

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\10a63fb12bcb5c72c8effdb907ecf4c5aceb8e4bf8808bac6465f9465f43a2e6.exe
    "C:\Users\Admin\AppData\Local\Temp\10a63fb12bcb5c72c8effdb907ecf4c5aceb8e4bf8808bac6465f9465f43a2e6.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:2076
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -windowstyle hidden "$Metacromion=Get-Content 'C:\Users\Admin\AppData\Local\darwan\Evase.Fag';$Hjbarmet=$Metacromion.SubString(45935,3);.$Hjbarmet($Metacromion)"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1056

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nst78AA.tmp\nsExec.dll
    Filesize

    6KB

    MD5

    fa299e199922b3ba833be655a8d71b75

    SHA1

    4d74c53bb6927a2831df93af26f3e4e4fb007797

    SHA256

    49a6a1c1f19574b2a247ce6c5adc0751e046d27c30912816ba415f871b74ae5d

    SHA512

    7ceb64d3d826762994c48ffad3ad2234410cbcdbedfce9a2dc03d18915ce22d687173f90e954d7bdb0eae76954c360059ad761aedc48cd7fa4ec29d6094f6a65

    Download Submit

  • memory/1056-10-0x0000000073E40000-0x00000000743EB000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/1056-11-0x0000000073E40000-0x00000000743EB000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/1056-12-0x0000000002540000-0x0000000002580000-memory.dmp

    Filesize

    256KB

    Download

  • memory/1056-13-0x0000000002540000-0x0000000002580000-memory.dmp

    Filesize

    256KB

    Download

  • memory/1056-14-0x0000000073E40000-0x00000000743EB000-memory.dmp

    Filesize

    5.7MB

    Download