aca1e5edffd286a3d4e0c66761072ed4bdfef3482d14769e2d8d43f8a9bef7dc

Analysis

max time kernel
147s
max time network
126s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25/04/2024, 01:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aca1e5edffd286a3d4e0c66761072ed4bdfef3482d14769e2d8d43f8a9bef7dc.exe
Size

410KB
MD5

cb8afa901f709e43154736a5c75b4d51
SHA1

c526715d221ae8986088d4427044e8e6a33b7706
SHA256

aca1e5edffd286a3d4e0c66761072ed4bdfef3482d14769e2d8d43f8a9bef7dc
SHA512

fc1c1ab2484fc0ee0ae17ab16b92383ee2ffcba86f4147f13919fba483971a9ad24e2abfe1343259d481fc5d3077c1f11be526743e9c4106733f95e03a5cdf6b
SSDEEP

12288:CxIK9V14ImyHYnYPfCBjrWHFg92ROB82wh2:CJEyYnkC8cpdN

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1824	kmmlbj.exe

Loads dropped DLL 2 IoCs

pid	Process
2076	aca1e5edffd286a3d4e0c66761072ed4bdfef3482d14769e2d8d43f8a9bef7dc.exe
2076	aca1e5edffd286a3d4e0c66761072ed4bdfef3482d14769e2d8d43f8a9bef7dc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\kmmlbj.exe"	kmmlbj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 1824	2076	aca1e5edffd286a3d4e0c66761072ed4bdfef3482d14769e2d8d43f8a9bef7dc.exe	28
PID 2076 wrote to memory of 1824	2076	aca1e5edffd286a3d4e0c66761072ed4bdfef3482d14769e2d8d43f8a9bef7dc.exe	28
PID 2076 wrote to memory of 1824	2076	aca1e5edffd286a3d4e0c66761072ed4bdfef3482d14769e2d8d43f8a9bef7dc.exe	28
PID 2076 wrote to memory of 1824	2076	aca1e5edffd286a3d4e0c66761072ed4bdfef3482d14769e2d8d43f8a9bef7dc.exe	28

C:\Users\Admin\AppData\Local\Temp\aca1e5edffd286a3d4e0c66761072ed4bdfef3482d14769e2d8d43f8a9bef7dc.exe
"C:\Users\Admin\AppData\Local\Temp\aca1e5edffd286a3d4e0c66761072ed4bdfef3482d14769e2d8d43f8a9bef7dc.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2076
- C:\ProgramData\kmmlbj.exe
  "C:\ProgramData\kmmlbj.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings .exe

Filesize
410KB

MD5
37869068ccc5d3a57f6501700a7d41f8

SHA1
07d3b813cc632810d5803087af88c9154bdbc109

SHA256
1d080a0579f98f51e129369c8a507188623e62f00583ff6d5bffddcec319a3ec

SHA512
af9602d9060f24ec29ac877dc0a447d599296d5f043c5942592095c4e250f3218fdd69d17650d7d63fbed5da0ecf76b5acfcab4b51face41d988a6411fa851ab

Download Submit
C:\ProgramData\Saaaalamm\Mira.h

Filesize
150KB

MD5
a52d6cb53c4c31e9f5ad53a356adf9dd

SHA1
4e9b2d208dc3c3a6e23decb0a7d7381c73f7b101

SHA256
f6bc441488529eadccfef115d11fa10c5cb8cb125b6c08c52a2bbc144bd4f7d8

SHA512
6d86153ffb8c803092d4fe30f1df1371657023eb10fd56dfeca684ff13a3222f64b11592576d3990f14cf915987a3372cf89774f811ef33dbd5f1b7db5ba681b

Download Submit
\ProgramData\kmmlbj.exe

Filesize
260KB

MD5
808560e272f5c765f2eb923301522cf0

SHA1
6005d34d3769359c46d0da935191739763c3308c

SHA256
ba04353759626fe546bdfcc7af2c96eac152a6886b59021443c87b7d7a857f80

SHA512
57525354d5a69a7435c418ad0f4fda415ba1e177e0f20acb90b05ad81247cfe07dcec1461863bab553b53fe9f7f595dbc7253496c50f5f521f81713938453f60

Download Submit
memory/1824-133-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2076-1-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2076-0-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2076-14-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads