2c530ed945a42c9a2e50162d8f80529062d4e9dc918e7e691422fd16896996a0

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 19:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c530ed945a42c9a2e50162d8f80529062d4e9dc918e7e691422fd16896996a0.exe
Size

53KB
MD5

18ecf1982a274963dbc1a56a83917665
SHA1

3619a40649841006108440a0e4f03dae981fa22b
SHA256

2c530ed945a42c9a2e50162d8f80529062d4e9dc918e7e691422fd16896996a0
SHA512

85325fb8a259fda9a4a824fa6ce0696d29b6d01447ecb6e320d60a391354dacedbb09cb037550bddeb886b1c52487c607a009360bb473d13ac7542f00b8e0e63
SSDEEP

768:MApQr0ovdFJI34eGxusOy9Rp1pLeAxoeC48PqK1OtaP6cCFzENREMZ7Vnh:MAaDJlMsh7pWezEPJB+O3

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2936	sal.exe

Loads dropped DLL 2 IoCs

pid	Process
2268	2c530ed945a42c9a2e50162d8f80529062d4e9dc918e7e691422fd16896996a0.exe
2268	2c530ed945a42c9a2e50162d8f80529062d4e9dc918e7e691422fd16896996a0.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\sal.exe	2c530ed945a42c9a2e50162d8f80529062d4e9dc918e7e691422fd16896996a0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2936	2268	2c530ed945a42c9a2e50162d8f80529062d4e9dc918e7e691422fd16896996a0.exe	28
PID 2268 wrote to memory of 2936	2268	2c530ed945a42c9a2e50162d8f80529062d4e9dc918e7e691422fd16896996a0.exe	28
PID 2268 wrote to memory of 2936	2268	2c530ed945a42c9a2e50162d8f80529062d4e9dc918e7e691422fd16896996a0.exe	28
PID 2268 wrote to memory of 2936	2268	2c530ed945a42c9a2e50162d8f80529062d4e9dc918e7e691422fd16896996a0.exe	28

C:\Users\Admin\AppData\Local\Temp\2c530ed945a42c9a2e50162d8f80529062d4e9dc918e7e691422fd16896996a0.exe
"C:\Users\Admin\AppData\Local\Temp\2c530ed945a42c9a2e50162d8f80529062d4e9dc918e7e691422fd16896996a0.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2268
- C:\windows\SysWOW64\sal.exe
  "C:\windows\system32\sal.exe"
  2⤵
  - Executes dropped EXE
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\sal.exe

Filesize
53KB

MD5
6b6259160e4e775f0c8e7ba96bd863ba

SHA1
c5fde0e7da3cb7d3ea09bd98d603fdac519649b3

SHA256
1861bf9f49649be09a68823b985ef61585c6d370c97065abfbae56e0e4a93c6b

SHA512
e4f7758889070c327962798f00d02b2ec9b4985cfb18ab42f16f8b511776b9ab82024ee4861e6dc84e9bcddea8a8bf81b5d810dd44e64be08ffbfa4a34ec214c

Download Submit
memory/2268-1-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2268-4-0x00000000029F0000-0x00000000029F9000-memory.dmp

Filesize
36KB

Download
memory/2936-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download