648e1df3a8a3dac49c36ca68519cd170550123606acafb1ce4e26aaf41813446

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 20:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

648e1df3a8a3dac49c36ca68519cd170550123606acafb1ce4e26aaf41813446.exe
Size

58KB
MD5

6a9e3d6a96f4fee7a83b29248b80bf87
SHA1

015584b559ec37f3f871f823a4b7c2eacedf5db6
SHA256

648e1df3a8a3dac49c36ca68519cd170550123606acafb1ce4e26aaf41813446
SHA512

f7855969b64effd7f66e6190b5b08d6f5308ebb71d39ea7bced79f43132c1bb9a3ca9fb0338a3494eca44bd1223383a035e607595472db3f25fa03694a21cc96
SSDEEP

768:eApQr0GvdFJI34qGxusOy9Rp1pLeAxoeC48PqK1OtaP6qlhqy5Gi0AGw+Zd597P0:eAapJlQsh7pWezEPLV65HVS

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1724	sal.exe

Loads dropped DLL 2 IoCs

pid	Process
1656	648e1df3a8a3dac49c36ca68519cd170550123606acafb1ce4e26aaf41813446.exe
1656	648e1df3a8a3dac49c36ca68519cd170550123606acafb1ce4e26aaf41813446.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\sal.exe	648e1df3a8a3dac49c36ca68519cd170550123606acafb1ce4e26aaf41813446.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1724	1656	648e1df3a8a3dac49c36ca68519cd170550123606acafb1ce4e26aaf41813446.exe	28
PID 1656 wrote to memory of 1724	1656	648e1df3a8a3dac49c36ca68519cd170550123606acafb1ce4e26aaf41813446.exe	28
PID 1656 wrote to memory of 1724	1656	648e1df3a8a3dac49c36ca68519cd170550123606acafb1ce4e26aaf41813446.exe	28
PID 1656 wrote to memory of 1724	1656	648e1df3a8a3dac49c36ca68519cd170550123606acafb1ce4e26aaf41813446.exe	28

C:\Users\Admin\AppData\Local\Temp\648e1df3a8a3dac49c36ca68519cd170550123606acafb1ce4e26aaf41813446.exe
"C:\Users\Admin\AppData\Local\Temp\648e1df3a8a3dac49c36ca68519cd170550123606acafb1ce4e26aaf41813446.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1656
- C:\windows\SysWOW64\sal.exe
  "C:\windows\system32\sal.exe"
  2⤵
  - Executes dropped EXE
  PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\sal.exe

Filesize
59KB

MD5
2dfc39966cd53e5bc8dfdff7fc026fd7

SHA1
8d4b716e7f5db0442d340f173fa2f141ddc89613

SHA256
fde00c234dfa75d870b76a708bc020296d9a25da9f580461188e7a42ebded6b2

SHA512
be35ef20e5c23c690b9b1b381df9c29ed6920be665d89521a12ea04927f4eca58bca7e8660f6e2d1010a82823794d5a2bdf8aa98aa5d9d1c00fd6ad87fa09f24

Download Submit