a26fb9698eac9ee02b4ca7c65433483ee6f0a967b8b3096cda294f245f93daae

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a26fb9698eac9ee02b4ca7c65433483ee6f0a967b8b3096cda294f245f93daae.exe
Size

32KB
MD5

f4e6103df47a435c1084d88e335f3076
SHA1

0b020accbdf46f96fab024d92eaca4a1d6e9eeee
SHA256

a26fb9698eac9ee02b4ca7c65433483ee6f0a967b8b3096cda294f245f93daae
SHA512

fbcef1bd6f4499ded28cb1b2738f9f9deddea9661e00809eb9fc47c05bb25fd6df29628bc06e423dc06773d61d2d9d9dc9c98938cf8b1d1b8cef0509e9d0992c
SSDEEP

384:oPDUQ/pgeUkI74UHCsD2GAYIPHbABKwSU3Fexbzm+4VWuMGY:+l/43MUHB2XtvbA8QO6+SWgY

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2084	gffos.exe

Loads dropped DLL 2 IoCs

pid	Process
2984	a26fb9698eac9ee02b4ca7c65433483ee6f0a967b8b3096cda294f245f93daae.exe
2984	a26fb9698eac9ee02b4ca7c65433483ee6f0a967b8b3096cda294f245f93daae.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2984	a26fb9698eac9ee02b4ca7c65433483ee6f0a967b8b3096cda294f245f93daae.exe
2084	gffos.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2084	2984	a26fb9698eac9ee02b4ca7c65433483ee6f0a967b8b3096cda294f245f93daae.exe	28
PID 2984 wrote to memory of 2084	2984	a26fb9698eac9ee02b4ca7c65433483ee6f0a967b8b3096cda294f245f93daae.exe	28
PID 2984 wrote to memory of 2084	2984	a26fb9698eac9ee02b4ca7c65433483ee6f0a967b8b3096cda294f245f93daae.exe	28
PID 2984 wrote to memory of 2084	2984	a26fb9698eac9ee02b4ca7c65433483ee6f0a967b8b3096cda294f245f93daae.exe	28

C:\Users\Admin\AppData\Local\Temp\a26fb9698eac9ee02b4ca7c65433483ee6f0a967b8b3096cda294f245f93daae.exe
"C:\Users\Admin\AppData\Local\Temp\a26fb9698eac9ee02b4ca7c65433483ee6f0a967b8b3096cda294f245f93daae.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Users\Admin\AppData\Local\Temp\gffos.exe
  "C:\Users\Admin\AppData\Local\Temp\gffos.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\gffos.exe

Filesize
32KB

MD5
5b77cb155d7c375ae29610dbddfb5ec5

SHA1
750a01c22a6d2af576fac9ceb2957424260754f3

SHA256
af489ae381873d952ddff56e50724acb97aeffc22f1a4f0f32d4caf5cf610efd

SHA512
48e5a0ea4e31670bb4596d4345620e7c3922e475bc3e0f7d30674c8ba63dbbbe1fdd4e22c780cf38d8b90aa8252522e2770793b8eeb6071de4abb7822aeb628d

Download Submit
memory/2084-20-0x0000000000560000-0x0000000000568000-memory.dmp

Filesize
32KB

Download
memory/2984-0-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2984-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2984-7-0x00000000004F0000-0x00000000004F8000-memory.dmp

Filesize
32KB

Download