d9c1b1c573e275c5be6d52957e701bc30da803ed8a5dae727ba81fe4c9642183

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 04:24

Target

d9c1b1c573e275c5be6d52957e701bc30da803ed8a5dae727ba81fe4c9642183.exe
Size

448KB
MD5

db2c95b84c57c44a8a8592c1f6cdcc38
SHA1

8f9216cf99f6393ceca693e5d69fd88d54e9cb41
SHA256

d9c1b1c573e275c5be6d52957e701bc30da803ed8a5dae727ba81fe4c9642183
SHA512

7d1b03044e9661686953f869376b1c54a68a6476a911a865107a626cd7a2db1044ee0404138a8ffed614469c472c1bff0a0dfc09d1c58ef79704f8f3929d4f38
SSDEEP

6144:yDdxaOjFS7pQAnluY4Mzw5ykEjiPISUOgW9X+hOGzC/NM:UKq+SAlu0k5ykmZzcukG2/

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2604	CSYEVOI.exe

Loads dropped DLL 2 IoCs

pid	Process
3036	cmd.exe
3036	cmd.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\windows\system\CSYEVOI.exe	d9c1b1c573e275c5be6d52957e701bc30da803ed8a5dae727ba81fe4c9642183.exe
File opened for modification	C:\windows\system\CSYEVOI.exe	d9c1b1c573e275c5be6d52957e701bc30da803ed8a5dae727ba81fe4c9642183.exe
File created	C:\windows\system\CSYEVOI.exe.bat	d9c1b1c573e275c5be6d52957e701bc30da803ed8a5dae727ba81fe4c9642183.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2396	d9c1b1c573e275c5be6d52957e701bc30da803ed8a5dae727ba81fe4c9642183.exe
2604	CSYEVOI.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2396	d9c1b1c573e275c5be6d52957e701bc30da803ed8a5dae727ba81fe4c9642183.exe
2396	d9c1b1c573e275c5be6d52957e701bc30da803ed8a5dae727ba81fe4c9642183.exe
2604	CSYEVOI.exe
2604	CSYEVOI.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 3036	2396	d9c1b1c573e275c5be6d52957e701bc30da803ed8a5dae727ba81fe4c9642183.exe	28
PID 2396 wrote to memory of 3036	2396	d9c1b1c573e275c5be6d52957e701bc30da803ed8a5dae727ba81fe4c9642183.exe	28
PID 2396 wrote to memory of 3036	2396	d9c1b1c573e275c5be6d52957e701bc30da803ed8a5dae727ba81fe4c9642183.exe	28
PID 2396 wrote to memory of 3036	2396	d9c1b1c573e275c5be6d52957e701bc30da803ed8a5dae727ba81fe4c9642183.exe	28
PID 3036 wrote to memory of 2604	3036	cmd.exe	30
PID 3036 wrote to memory of 2604	3036	cmd.exe	30
PID 3036 wrote to memory of 2604	3036	cmd.exe	30
PID 3036 wrote to memory of 2604	3036	cmd.exe	30

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Windows\system\CSYEVOI.exe.bat

Filesize
74B

MD5
7af1f138b6bc1e713bf1c9bb5f87fbd6

SHA1
18618a7a6a39772eba6b3ec73f4f632ab5edcc74

SHA256
24aaeb3bc332fa25bb53acce67c4f81758e5f6c65b8492c7557731e779da764f

SHA512
c19bfbd72cf4059e21775be6461777fc919c0246f3c192cac170f260ca5de43a1ab6f9c6d9ff827dc6df1ea7384e280971c5fdb745319ebfe203e816d7837886

Download Submit
\Windows\system\CSYEVOI.exe

Filesize
448KB

MD5
25099482ab55fb6097f8c60e705c206d

SHA1
73b47318a9a807552f4504bbef6854cae0acc69e

SHA256
585f92d67834fede64f2af589789bd811bb8757bc1c32113178fb40a84501bab

SHA512
8acf2b251ed194b01739cf2edb3fc85af9f81e90223348f58276326dfae6115695838e08e80bf7694a95c1abb70bc3cfc871d4025e82edccaad95944feb38639

Download Submit
memory/2396-0-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2396-12-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2604-20-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2604-21-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3036-18-0x0000000000410000-0x0000000000449000-memory.dmp

Filesize
228KB

Download
memory/3036-17-0x0000000000410000-0x0000000000449000-memory.dmp

Filesize
228KB

Download