e0fb8d828a8eda306caa334148bfdaf539818481ffd7439a2606283a8171cb09

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 03:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e0fb8d828a8eda306caa334148bfdaf539818481ffd7439a2606283a8171cb09.exe
Size

81KB
MD5

a112d5ade831b828454a4bc4185ba13e
SHA1

9cbb196f6cb4ac96c16336bdeac75934b49b0f6e
SHA256

e0fb8d828a8eda306caa334148bfdaf539818481ffd7439a2606283a8171cb09
SHA512

c045a0437875c324c422a3588136fb259cce3d098b4ce4a86396e755e10e9df6274b4145df7da49d3b246453cb53cc6ad8fa2ddd5f6a3cd38a67a213e04ab527
SSDEEP

1536:sB+FC9RntfWeoGiPyCHjKDjvQQQtUw2dfkoT/y2Zl:sB+F8tfPN4yCDKDjvQQQtS

Score

9^/10

Malware Config

Signatures

Detects executables built or packed with MPress PE compressor 5 IoCs

resource	yara_rule
behavioral1/memory/2848-1-0x0000000000400000-0x000000000041D000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2848-2-0x0000000000400000-0x000000000041D000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2848-14-0x0000000000400000-0x000000000041D000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2496-16-0x0000000000400000-0x000000000041D000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2496-18-0x0000000000400000-0x000000000041D000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 1 IoCs

pid	Process
2496	budha.exe

Loads dropped DLL 2 IoCs

pid	Process
2848	e0fb8d828a8eda306caa334148bfdaf539818481ffd7439a2606283a8171cb09.exe
2848	e0fb8d828a8eda306caa334148bfdaf539818481ffd7439a2606283a8171cb09.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2496	2848	e0fb8d828a8eda306caa334148bfdaf539818481ffd7439a2606283a8171cb09.exe	28
PID 2848 wrote to memory of 2496	2848	e0fb8d828a8eda306caa334148bfdaf539818481ffd7439a2606283a8171cb09.exe	28
PID 2848 wrote to memory of 2496	2848	e0fb8d828a8eda306caa334148bfdaf539818481ffd7439a2606283a8171cb09.exe	28
PID 2848 wrote to memory of 2496	2848	e0fb8d828a8eda306caa334148bfdaf539818481ffd7439a2606283a8171cb09.exe	28

C:\Users\Admin\AppData\Local\Temp\e0fb8d828a8eda306caa334148bfdaf539818481ffd7439a2606283a8171cb09.exe
"C:\Users\Admin\AppData\Local\Temp\e0fb8d828a8eda306caa334148bfdaf539818481ffd7439a2606283a8171cb09.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Executes dropped EXE
  PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
81KB

MD5
9e7f0eb2a742ec7e7f66869b4419876f

SHA1
e7a23153e905bedf931d312af2ef565136a79ca6

SHA256
97cb7fc0e8bf5f1d54c27a5be6acc4e1f0c580de4a39f733741e56b5bfccbb72

SHA512
48bde88553069ac0d8a4568e4142fe13d9f31407134ec384068367dd131b0f0353eb3dbdc7f7ed89e405236364741befe9ed1783b12a8c555fe9bb73a9c12c02

Download Submit
memory/2496-16-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2496-18-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2496-19-0x0000000002020000-0x0000000002021000-memory.dmp

Filesize
4KB

Download
memory/2496-20-0x0000000002AE0000-0x0000000002EE0000-memory.dmp

Filesize
4.0MB

Download
memory/2848-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2848-1-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2848-2-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2848-4-0x0000000000470000-0x0000000000471000-memory.dmp

Filesize
4KB

Download
memory/2848-5-0x0000000002970000-0x0000000002D70000-memory.dmp

Filesize
4.0MB

Download
memory/2848-14-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2848-13-0x00000000030E0000-0x00000000030FD000-memory.dmp

Filesize
116KB

Download