61f4a7effc73da1a5dae33a9f4f010cde61e94d3f691163f240175699a1064d8

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 14:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5aa549f5aff79d452ec5e187221176ef09baeef818c490b4bbc3793c5cb7298c.exe
Size

466KB
MD5

541b03ee03c86fb9898a7b9a3fce1877
SHA1

8e00390087cd5bca52e1b5d25115560b60e9ba85
SHA256

5aa549f5aff79d452ec5e187221176ef09baeef818c490b4bbc3793c5cb7298c
SHA512

4d94a3ea828deb9244eae425899fcb00c97348b8ca60cc0be7d1960acf84e4ba3c79689f80e675a896ae0e73e8e5445d9974d5334a6f8568f6f8c4ee70583bc6
SSDEEP

12288:ZHuGxNa/9j1oggP15skZQ+uwypDxfXikgqKeS:ZH9N4pVksg7XYDlykge

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1908	5aa549f5aff79d452ec5e187221176ef09baeef818c490b4bbc3793c5cb7298c.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1908	5aa549f5aff79d452ec5e187221176ef09baeef818c490b4bbc3793c5cb7298c.exe
2684	5aa549f5aff79d452ec5e187221176ef09baeef818c490b4bbc3793c5cb7298c.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1908 set thread context of 2684	1908	5aa549f5aff79d452ec5e187221176ef09baeef818c490b4bbc3793c5cb7298c.exe	28

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Hoffmann.ini	5aa549f5aff79d452ec5e187221176ef09baeef818c490b4bbc3793c5cb7298c.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\electronarcosis.beg	5aa549f5aff79d452ec5e187221176ef09baeef818c490b4bbc3793c5cb7298c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1908	5aa549f5aff79d452ec5e187221176ef09baeef818c490b4bbc3793c5cb7298c.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2684	1908	5aa549f5aff79d452ec5e187221176ef09baeef818c490b4bbc3793c5cb7298c.exe	28
PID 1908 wrote to memory of 2684	1908	5aa549f5aff79d452ec5e187221176ef09baeef818c490b4bbc3793c5cb7298c.exe	28
PID 1908 wrote to memory of 2684	1908	5aa549f5aff79d452ec5e187221176ef09baeef818c490b4bbc3793c5cb7298c.exe	28
PID 1908 wrote to memory of 2684	1908	5aa549f5aff79d452ec5e187221176ef09baeef818c490b4bbc3793c5cb7298c.exe	28
PID 1908 wrote to memory of 2684	1908	5aa549f5aff79d452ec5e187221176ef09baeef818c490b4bbc3793c5cb7298c.exe	28
PID 1908 wrote to memory of 2684	1908	5aa549f5aff79d452ec5e187221176ef09baeef818c490b4bbc3793c5cb7298c.exe	28

C:\Users\Admin\AppData\Local\Temp\5aa549f5aff79d452ec5e187221176ef09baeef818c490b4bbc3793c5cb7298c.exe
"C:\Users\Admin\AppData\Local\Temp\5aa549f5aff79d452ec5e187221176ef09baeef818c490b4bbc3793c5cb7298c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Users\Admin\AppData\Local\Temp\5aa549f5aff79d452ec5e187221176ef09baeef818c490b4bbc3793c5cb7298c.exe
  "C:\Users\Admin\AppData\Local\Temp\5aa549f5aff79d452ec5e187221176ef09baeef818c490b4bbc3793c5cb7298c.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nso5227.tmp\System.dll

Filesize
11KB

MD5
3f176d1ee13b0d7d6bd92e1c7a0b9bae

SHA1
fe582246792774c2c9dd15639ffa0aca90d6fd0b

SHA256
fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e

SHA512
0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6

Download Submit
memory/1908-15-0x0000000076F00000-0x00000000770A9000-memory.dmp

Filesize
1.7MB

Download
memory/1908-16-0x00000000770F0000-0x00000000771C6000-memory.dmp

Filesize
856KB

Download
memory/1908-17-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download
memory/2684-18-0x0000000076F00000-0x00000000770A9000-memory.dmp

Filesize
1.7MB

Download
memory/2684-19-0x0000000077126000-0x0000000077127000-memory.dmp

Filesize
4KB

Download
memory/2684-20-0x0000000072530000-0x0000000073592000-memory.dmp

Filesize
16.4MB

Download
memory/2684-22-0x00000000770F0000-0x00000000771C6000-memory.dmp

Filesize
856KB

Download