b705477fbc09afa213224a235b1b5dbf907c2a83b8e3a7d21026b76856c1e7b5

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b705477fbc09afa213224a235b1b5dbf907c2a83b8e3a7d21026b76856c1e7b5.exe
Size

59KB
MD5

8b6eb69e23d258194be66642ea1f8d85
SHA1

5c55c40a4604db995a4f0d3e8251ae433d9677b9
SHA256

b705477fbc09afa213224a235b1b5dbf907c2a83b8e3a7d21026b76856c1e7b5
SHA512

370edace6d36caa20b7aecae02c94811f43eb7e8e86d1c90352e844f701a7d40b5085e96e0182af054445825ac26b685eb12798ec06d68fd2861ad1bdcc4c5e7
SSDEEP

1536:35H5545555555555555555555Au5555555555555555Fq555555555555555555c:/+jUQQQtB

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2412	nmiya.exe

Loads dropped DLL 2 IoCs

pid	Process
2232	b705477fbc09afa213224a235b1b5dbf907c2a83b8e3a7d21026b76856c1e7b5.exe
2232	b705477fbc09afa213224a235b1b5dbf907c2a83b8e3a7d21026b76856c1e7b5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2412	2232	b705477fbc09afa213224a235b1b5dbf907c2a83b8e3a7d21026b76856c1e7b5.exe	28
PID 2232 wrote to memory of 2412	2232	b705477fbc09afa213224a235b1b5dbf907c2a83b8e3a7d21026b76856c1e7b5.exe	28
PID 2232 wrote to memory of 2412	2232	b705477fbc09afa213224a235b1b5dbf907c2a83b8e3a7d21026b76856c1e7b5.exe	28
PID 2232 wrote to memory of 2412	2232	b705477fbc09afa213224a235b1b5dbf907c2a83b8e3a7d21026b76856c1e7b5.exe	28

C:\Users\Admin\AppData\Local\Temp\b705477fbc09afa213224a235b1b5dbf907c2a83b8e3a7d21026b76856c1e7b5.exe
"C:\Users\Admin\AppData\Local\Temp\b705477fbc09afa213224a235b1b5dbf907c2a83b8e3a7d21026b76856c1e7b5.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Users\Admin\AppData\Local\Temp\nmiya.exe
  "C:\Users\Admin\AppData\Local\Temp\nmiya.exe"
  2⤵
  - Executes dropped EXE
  PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nmiya.exe

Filesize
59KB

MD5
0329a7f3f671ae18f8a32eea40a8b6a0

SHA1
c3781df469cc63afcd79cb64aaddd13945ef2721

SHA256
3908e892028c5398012dfb85ef6ca805a6bad046bc2d4370df8c3601fbbae03b

SHA512
c17b295e998e0554efbc3d77e45aca0f4f68e35123e2424832a185ae45a2b1842cc19ee4f8b9cc65014f00d7b10f662b79505f506b6647222269287dbac46dbd

Download Submit
memory/2232-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2232-2-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2232-11-0x00000000003D0000-0x00000000003E5000-memory.dmp

Filesize
84KB

Download
memory/2412-13-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2412-15-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download