047edbde3d145973b9e2a30ce5b0c7f9db4dd5d5bd74ec0608858a0de0c95ef6

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 04:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Trojan.DownLoader45.24277.9966.19180.exe
Size 4.9MB
Sample240327-et8dmsfe6x
SHA256 047edbde3d145973b9e2a30ce5b0c7f9db4dd5d5bd74ec0608858a0de0c95ef6
MD5 19576c98fa5e592122a48124224c8e7d
SHA1 9cd6a1b42e0bead2690d63572bdae619b853a9d1
SHA512 a4648377902d056ab52468df912d9202ead7f3c95a4195a3733fae45bc3895212b9ee7008c88636d768ce4cbd2bbceffa11059f5de3e32b18b786a736f9f2bfa
SSDEEP 98304:CXrlkQBy+Z8yQf7jKi6fjfKdW2+HwWMQti0FTzL1eNRSiqZkn80gSkOzk:0xy8HujWPPlMxQPL1eNRSiqWn80YOzk
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1392	SecuriteInfo.com.Trojan.DownLoader45.24277.9966.19180.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 1392	5096	SecuriteInfo.com.Trojan.DownLoader45.24277.9966.19180.exe	96
PID 5096 wrote to memory of 1392	5096	SecuriteInfo.com.Trojan.DownLoader45.24277.9966.19180.exe	96
PID 5096 wrote to memory of 1392	5096	SecuriteInfo.com.Trojan.DownLoader45.24277.9966.19180.exe	96

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader45.24277.9966.19180.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader45.24277.9966.19180.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Users\Admin\AppData\Local\Temp\is-K48S5.tmp\SecuriteInfo.com.Trojan.DownLoader45.24277.9966.19180.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-K48S5.tmp\SecuriteInfo.com.Trojan.DownLoader45.24277.9966.19180.tmp" /SL5="$D0060,4885030,54272,C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader45.24277.9966.19180.exe"
  2⤵
  - Executes dropped EXE
  PID:1392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:4312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SecuriteInfo.com.Trojan.DownLoader45.24277.9966.19180.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-K48S5.tmp\SecuriteInfo.com.Trojan.DownLoader45.24277.9966.19180.tmp
Size 680KB
SHA256 78f6692d50d07bd78a97294d196f9ae7d1fc48b058375e5d7bb766970faab758
MD5 e60a74a65005e4c4f61cbe9c09d368df
SHA1 1d649b2ab5e08632d64e23f5f9e5675b68e184b4
SHA512 a73b84739f4da0827976cf473e63ba3dc7649ab2d37be13c8fb786487d0dc7ef5b2bd446d8c745d75266447357bde4f32f58f1f1c92b156f06f141fea2873856
SSDEEP 12288:q0QfKb7nH5lrPo37AzHTA63I0ihE4qE7prN9cgKARpkZXYnXExy8:qfKbT5lrPo37AzHTA63/cfqAcgKckZI0
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1392-6-0x0000000002350000-0x0000000002351000-memory.dmp

Download

memory/1392-13-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1392-16-0x0000000002350000-0x0000000002351000-memory.dmp

Download

memory/5096-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5096-12-0x0000000000400000-0x0000000000414000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads