027545e09f397707e98abf5c192c35e5b01a51a74edc2070b9f950140b5c3ef2

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-03-2024 01:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

027545e09f397707e98abf5c192c35e5b01a51a74edc2070b9f950140b5c3ef2.exe
Size

555KB
MD5

99b3c84d119b8d3173aa52f40871a090
SHA1

029c6d4d7f5509bed4fe65e2ee961c058d896a61
SHA256

027545e09f397707e98abf5c192c35e5b01a51a74edc2070b9f950140b5c3ef2
SHA512

f7e1bd7e12d6e34deb0c40bd4bdc4b69c6fc7d43feb8671212eb8ac588a3d1e26922be5edb7d28997b088f5e3bbea72b61e98cb160c7288f18e0b1ae10302448
SSDEEP

12288:ZCcSi/icxi33VLqAdQqW8sHPS9ojrO+HTG07rS:ZoiKainVPdQBSuGyG0K

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

027545e09f397707e98abf5c192c35e5b01a51a74edc2070b9f950140b5c3ef2.exe

pid process

1932 027545e09f397707e98abf5c192c35e5b01a51a74edc2070b9f950140b5c3ef2.exe

pid	process
1932	027545e09f397707e98abf5c192c35e5b01a51a74edc2070b9f950140b5c3ef2.exe

Drops file in System32 directory 2 IoCs

Processes:

027545e09f397707e98abf5c192c35e5b01a51a74edc2070b9f950140b5c3ef2.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\orthopteran\inornateness.mel	027545e09f397707e98abf5c192c35e5b01a51a74edc2070b9f950140b5c3ef2.exe
File opened for modification	C:\Windows\SysWOW64\nordbrandts\bogbussens.pro	027545e09f397707e98abf5c192c35e5b01a51a74edc2070b9f950140b5c3ef2.exe

Drops file in Program Files directory 3 IoCs

Processes:

027545e09f397707e98abf5c192c35e5b01a51a74edc2070b9f950140b5c3ef2.exe

description	ioc	process
File created	C:\Program Files (x86)\opalesces\Redheadedness.lnk	027545e09f397707e98abf5c192c35e5b01a51a74edc2070b9f950140b5c3ef2.exe
File opened for modification	C:\Program Files (x86)\Common Files\Lysbade6\omringe.ber	027545e09f397707e98abf5c192c35e5b01a51a74edc2070b9f950140b5c3ef2.exe
File opened for modification	C:\Program Files (x86)\Common Files\egilds.Har	027545e09f397707e98abf5c192c35e5b01a51a74edc2070b9f950140b5c3ef2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2936 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2936 powershell.exe

pid	process
2936	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2936	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

027545e09f397707e98abf5c192c35e5b01a51a74edc2070b9f950140b5c3ef2.exe

description	pid	process	target process
PID 1932 wrote to memory of 2936	1932	027545e09f397707e98abf5c192c35e5b01a51a74edc2070b9f950140b5c3ef2.exe	powershell.exe
PID 1932 wrote to memory of 2936	1932	027545e09f397707e98abf5c192c35e5b01a51a74edc2070b9f950140b5c3ef2.exe	powershell.exe
PID 1932 wrote to memory of 2936	1932	027545e09f397707e98abf5c192c35e5b01a51a74edc2070b9f950140b5c3ef2.exe	powershell.exe
PID 1932 wrote to memory of 2936	1932	027545e09f397707e98abf5c192c35e5b01a51a74edc2070b9f950140b5c3ef2.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\027545e09f397707e98abf5c192c35e5b01a51a74edc2070b9f950140b5c3ef2.exe
"C:\Users\Admin\AppData\Local\Temp\027545e09f397707e98abf5c192c35e5b01a51a74edc2070b9f950140b5c3ef2.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -windowstyle hidden "$Fikserbart=Get-Content 'C:\Users\Admin\AppData\Roaming\kraftfuldheders\Fide231\recited\Overstretch\Automobilfirmaers\Natchezan\Outreckon.Sty';$Stormlbs=$Fikserbart.SubString(56995,3);.$Stormlbs($Fikserbart)"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2936

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsd8DA0.tmp\nsExec.dll
Filesize
6KB

MD5
51e63a9c5d6d230ef1c421b2eccd45dc

SHA1
c499cdad5c613d71ed3f7e93360f1bbc5748c45d

SHA256
cd8496a3802378391ec425dec424a14f5d30e242f192ec4eb022d767f9a2480f

SHA512
c23d713c3c834b3397c2a199490aed28f28d21f5781205c24df5e1e32365985c8a55be58f06979df09222740ffa51f4da764ebc3d912cd0c9d56ab6a33cab522

Download Submit
memory/2936-23-0x0000000073810000-0x0000000073DBB000-memory.dmp

Filesize
5.7MB

Download
memory/2936-24-0x0000000073810000-0x0000000073DBB000-memory.dmp

Filesize
5.7MB

Download
memory/2936-25-0x00000000022D0000-0x0000000002310000-memory.dmp

Filesize
256KB

Download
memory/2936-26-0x00000000022D0000-0x0000000002310000-memory.dmp

Filesize
256KB

Download
memory/2936-27-0x00000000022D0000-0x0000000002310000-memory.dmp

Filesize
256KB

Download
memory/2936-28-0x0000000073810000-0x0000000073DBB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads