62cbfb33edfd6ab2e583089ef7a91eb5803640234896210f372f504f4940e88b

Analysis

max time kernel
148s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/04/2024, 16:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62cbfb33edfd6ab2e583089ef7a91eb5803640234896210f372f504f4940e88b.exe
Size

28KB
MD5

70b5c8ef702a1f89f862f12a20be4397
SHA1

a9d22d97d645b5aba2dafde20bdd454988847195
SHA256

62cbfb33edfd6ab2e583089ef7a91eb5803640234896210f372f504f4940e88b
SHA512

27333dd04b193ea63007566e00cb7f9fbf5f1b76ae59678dfacad5d78d735370a51a91cdcf6de775c327c9b7d06f8c835e12d02ef62ab7786b9e046cc177af07
SSDEEP

384:JqVhC8fB4PhdQ6hjkPUGuqfvUOKGsw5SF0f9JTezLxwgSQlak9/jK4G0AKL5k:JQhcJdQ6hjV7fm9JqRvtlaEjK4OOk

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2072	budha.exe

Loads dropped DLL 1 IoCs

pid	Process
2168	62cbfb33edfd6ab2e583089ef7a91eb5803640234896210f372f504f4940e88b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2072	2168	62cbfb33edfd6ab2e583089ef7a91eb5803640234896210f372f504f4940e88b.exe	28
PID 2168 wrote to memory of 2072	2168	62cbfb33edfd6ab2e583089ef7a91eb5803640234896210f372f504f4940e88b.exe	28
PID 2168 wrote to memory of 2072	2168	62cbfb33edfd6ab2e583089ef7a91eb5803640234896210f372f504f4940e88b.exe	28
PID 2168 wrote to memory of 2072	2168	62cbfb33edfd6ab2e583089ef7a91eb5803640234896210f372f504f4940e88b.exe	28

C:\Users\Admin\AppData\Local\Temp\62cbfb33edfd6ab2e583089ef7a91eb5803640234896210f372f504f4940e88b.exe
"C:\Users\Admin\AppData\Local\Temp\62cbfb33edfd6ab2e583089ef7a91eb5803640234896210f372f504f4940e88b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Executes dropped EXE
  PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
28KB

MD5
e82b570ee4916d2c99e110ded9fb0f5f

SHA1
dc4c13154ad107fed4fb5cf55ea263b59c7c230e

SHA256
f62d9fca53d7843fac7e0b98940258986c9529af823bb6f0f50548570b51de98

SHA512
c9d05025ae49ad328374a01a4d20277d0fd5d1e63364c2b8798f55c6e670b1aab21d4a5f864bf516e7103a9ba6106695525bca1af0853dfdfbf52b26031746c9

Download Submit
memory/2072-11-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2072-13-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/2072-14-0x00000000025E0000-0x00000000029E0000-memory.dmp

Filesize
4.0MB

Download
memory/2072-31-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2168-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2168-1-0x0000000002620000-0x0000000002621000-memory.dmp

Filesize
4KB

Download
memory/2168-3-0x0000000002630000-0x0000000002A30000-memory.dmp

Filesize
4.0MB

Download
memory/2168-9-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2168-8-0x0000000002E90000-0x0000000002E97000-memory.dmp

Filesize
28KB

Download