5bfc1cda22d5bf12a41db3261e1516fa427d0901f1bf6733534d16320bf9594d

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-03-2024 13:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de24108b45bd3191f003d0c3e42fe7e4.exe
Size

71KB
MD5

de24108b45bd3191f003d0c3e42fe7e4
SHA1

8af450a9d0bf394aeb6fc42ba04be0eb26649f07
SHA256

5bfc1cda22d5bf12a41db3261e1516fa427d0901f1bf6733534d16320bf9594d
SHA512

ac033b4765a3c4b427e7955cef9eb480e39c5b86feaa123eff4034d0de843923e500b40acf4ed8f9baf6b5bb9c494004e08ba3e13a48927a0461cd9551107037
SSDEEP

1536:WpgpHzb9dZVX9fHMvG0D3XJ7JGjdA4yL6j22HpkVhahJGjT:8gXdZt9P6D3XJEiwTpU7H

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
2004	de24108b45bd3191f003d0c3e42fe7e4.exe
2004	de24108b45bd3191f003d0c3e42fe7e4.exe
2004	de24108b45bd3191f003d0c3e42fe7e4.exe
2004	de24108b45bd3191f003d0c3e42fe7e4.exe
2004	de24108b45bd3191f003d0c3e42fe7e4.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Addendum\admrup.exe	de24108b45bd3191f003d0c3e42fe7e4.exe
File created	C:\Program Files (x86)\Addendum\admmgr.exe	de24108b45bd3191f003d0c3e42fe7e4.exe
File created	C:\Program Files (x86)\Addendum\iesb_nm.dll	de24108b45bd3191f003d0c3e42fe7e4.exe
File created	C:\Program Files (x86)\Addendum\iesm_nm.dll	de24108b45bd3191f003d0c3e42fe7e4.exe
File created	C:\Program Files (x86)\Addendum\srnm.dll	de24108b45bd3191f003d0c3e42fe7e4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\de24108b45bd3191f003d0c3e42fe7e4.exe
"C:\Users\Admin\AppData\Local\Temp\de24108b45bd3191f003d0c3e42fe7e4.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsi3ED5.tmp\InetLoad.dll

Filesize
18KB

MD5
994669c5737b25c26642c94180e92fa2

SHA1
d8a1836914a446b0e06881ce1be8631554adafde

SHA256
bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c

SHA512
d0ab7ca7f890ef9e59015c33e6b400a0a4d1ce0d24599537e09e845f4b953e3ecd44bf3e3cbe584f57c2948743e689ed67d2d40e6caf923bd630886e89c38563

Download Submit