71bddd1271108df25bfb9edfb2c565f9f4276f6266ed8c10bc837c498a6e1243

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 22:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71bddd1271108df25bfb9edfb2c565f9f4276f6266ed8c10bc837c498a6e1243.exe
Size

61KB
MD5

212ceff43d8c4751e971668471db9ede
SHA1

45ae86e0946a25a12366ba63a5ba7f1c7f832d60
SHA256

71bddd1271108df25bfb9edfb2c565f9f4276f6266ed8c10bc837c498a6e1243
SHA512

dfa7cfff270c87c33e3a080d789f7abc6376af0d62080b2f7cf53da2212c0a90047b7b57b32c72832ffa16808dbd584de8e0d376b0d968e83b0f70e098a13c63
SSDEEP

768:qRVyGrbqomOIPpkbWJu8T3maD2o28H1w4Btj1rlI/LaBfDOzQ:CXIOAowuQVw4BtI25iM

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2924	segnc.exe

Loads dropped DLL 1 IoCs

pid	Process
1040	71bddd1271108df25bfb9edfb2c565f9f4276f6266ed8c10bc837c498a6e1243.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 2924	1040	71bddd1271108df25bfb9edfb2c565f9f4276f6266ed8c10bc837c498a6e1243.exe	28
PID 1040 wrote to memory of 2924	1040	71bddd1271108df25bfb9edfb2c565f9f4276f6266ed8c10bc837c498a6e1243.exe	28
PID 1040 wrote to memory of 2924	1040	71bddd1271108df25bfb9edfb2c565f9f4276f6266ed8c10bc837c498a6e1243.exe	28
PID 1040 wrote to memory of 2924	1040	71bddd1271108df25bfb9edfb2c565f9f4276f6266ed8c10bc837c498a6e1243.exe	28

C:\Users\Admin\AppData\Local\Temp\71bddd1271108df25bfb9edfb2c565f9f4276f6266ed8c10bc837c498a6e1243.exe
"C:\Users\Admin\AppData\Local\Temp\71bddd1271108df25bfb9edfb2c565f9f4276f6266ed8c10bc837c498a6e1243.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Users\Admin\AppData\Local\Temp\segnc.exe
  "C:\Users\Admin\AppData\Local\Temp\segnc.exe"
  2⤵
  - Executes dropped EXE
  PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\segnc.exe

Filesize
61KB

MD5
8a56737cba14a9367cc2bb93ce63266b

SHA1
9f0dc930121b9db7e9964e44f9c42b11530ff311

SHA256
0258a225c7c6cdfc7e3a31b7fd36bd4521da467ef32cf8f3a5f5e0779c8a43ca

SHA512
5b01dab6af9cecf6b74510474f8b0bd392ff5c0031a455f2b0c8e276f54100130ab0019a1d8a22faf0df6bb9ab3686ff2ac518e8ef9b2ea718c4384cb72bde93

Download Submit
memory/1040-1-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2924-8-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download