be5c9e6777d553873639e727b3b98c629f7d8e3fb86d818d1561e055a1557116

Resubmissions

18/04/2024, 09:57

240418-lzcx9ahg47 7

18/04/2024, 09:53

240418-lwy2baah9w 8

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 09:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DeepwokenMaster/Loader.exe
Size

7.0MB
MD5

a3664d37321d58e90f0cd8d988216063
SHA1

3261f93f6e3a83167a0d734d38ec36fff5d416aa
SHA256

63de4d3384ad10cd476d63b6c4df1a550ec99b21007660f2c2cb3455c021e202
SHA512

f52472a992ee6e2921256311855ebb9201a342e66f7a0068f259a6035eeb3ea7c91cbea549e5b732e9b19d4343f482da052cb62dc83e35bb90a62d01dad7b0cf
SSDEEP

196608:FP7+g/XnJYCdS7bIn7IaAlyH0F1OMI/P:5JZbS7Ua401M/P

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2500	test.exe

Loads dropped DLL 2 IoCs

pid	Process
2212	Loader.exe
2500	test.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2500	2212	Loader.exe	28
PID 2212 wrote to memory of 2500	2212	Loader.exe	28
PID 2212 wrote to memory of 2500	2212	Loader.exe	28

C:\Users\Admin\AppData\Local\Temp\DeepwokenMaster\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\DeepwokenMaster\Loader.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Users\Admin\AppData\Local\Temp\onefile_2212_133579076945402000\test.exe
  "C:\Users\Admin\AppData\Local\Temp\DeepwokenMaster\Loader.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\onefile_2212_133579076945402000\python311.dll

Filesize
5.5MB

MD5
1fe47c83669491bf38a949253d7d960f

SHA1
de5cc181c0e26cbcb31309fe00d9f2f5264d2b25

SHA256
0a9f2c98f36ba8974a944127b5b7e90e638010e472f2eb6598fc55b1bda9e7ae

SHA512
05cc6f00db128fbca02a14f60f86c049855f429013f65d91e14ea292d468bf9bfdeebc00ec2d54a9fb5715743a57ae3ab48a95037016240c02aabe4bfa1a2ff4

Download Submit
\Users\Admin\AppData\Local\Temp\onefile_2212_133579076945402000\test.exe

Filesize
8.4MB

MD5
a3ea9429621726dccc70f826ad7ad15c

SHA1
076126049402a4df2d313d4e38845a9792dbfdea

SHA256
2a50eaed6ccb9b45e9c65db0bfe5af5b013b9685395d53faddbb5bd1d7037784

SHA512
55e915cdcdd5e61b77cc9f2d4e0301a4dc07dac764af7d39c1082c59b6c9f615b49d2e0d8d58b5bc8bd3b561c270458c2e27f3babdbf0bd2f62e31150fa0da5e

Download Submit