3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255

Analysis

max time kernel
144s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 21:18

Target

3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe
Size

4.8MB
MD5

b3605edf698023865b1e65852ff9e627
SHA1

93c8ce5f7dd2e69edd50ef26d00f89b4bfbe20b7
SHA256

3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255
SHA512

e7a82bbcd5bf3c9799248ecb91837e5f94431e7a1ad5515dd847d1b1cfce44b76e37981694ae14e5f1f30eab3d98088ef4751ce9b8b83ea11bbc1d9c95ea8ad2
SSDEEP

12288:937z0DEczgGtM6oHYuFr7H13jeGeTaGHK4juSAxJWjbA/bJLoGI:WD2twmd

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

WXIEDFW8RB.exe

pid process

2096 WXIEDFW8RB.exe

pid	process
2096	WXIEDFW8RB.exe

Loads dropped DLL 2 IoCs

Processes:

3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe

pid	process
2952	3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe
2952	3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe

description	pid	process	target process
PID 2952 wrote to memory of 2096	2952	3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe	WXIEDFW8RB.exe
PID 2952 wrote to memory of 2096	2952	3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe	WXIEDFW8RB.exe
PID 2952 wrote to memory of 2096	2952	3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe	WXIEDFW8RB.exe
PID 2952 wrote to memory of 2096	2952	3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe	WXIEDFW8RB.exe

C:\Users\Admin\AppData\Local\Temp\3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe
"C:\Users\Admin\AppData\Local\Temp\3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2952
- C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\WXIEDFW8RB.exe
  "C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\WXIEDFW8RB.exe"
  2⤵
  - Executes dropped EXE
  PID:2096

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\WXIEDFW8RB.exe

Filesize
159KB

MD5
00333d129e6ef188664819662a141476

SHA1
41605ab3ceffff75a4abd29d2df0fe26bc7de8a1

SHA256
82314104e7bccbced4fbe95a65273d88678b183e45f4fffa8abf2a4ee6a06ee7

SHA512
cb762a2b092fe00ce7c6b99816084dfd6d34d59dde8eb6ccad5f8c031f892f0a495fce7e8600e8fdcd3989f828813a06a5dc23feeb5f2ba7c8c649b9f0a8a150

Download Submit
memory/2952-0-0x0000000000030000-0x00000000000A6000-memory.dmp

Filesize
472KB

Download
memory/2952-1-0x0000000074030000-0x000000007471E000-memory.dmp

Filesize
6.9MB

Download
memory/2952-2-0x00000000005D0000-0x0000000000610000-memory.dmp

Filesize
256KB

Download
memory/2952-7-0x0000000002010000-0x000000000204D000-memory.dmp

Filesize
244KB

Download
memory/2952-13-0x0000000074030000-0x000000007471E000-memory.dmp

Filesize
6.9MB

Download