ssload | e99c79bc77c3b9679a974cbb9fd4fe2a952c675f56a05503b505b24304ba23ba

Analysis

max time kernel
599s
max time network
596s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 18:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e99c79bc77c3b9679a974cbb9fd4fe2a952c675f56a05503b505b24304ba23ba.exe
Size

408KB
MD5

d98749205fff0909e335b5eeb1378973
SHA1

927e94563e873026f5a3964fee8b008c9ad84b7b
SHA256

e99c79bc77c3b9679a974cbb9fd4fe2a952c675f56a05503b505b24304ba23ba
SHA512

c635fe74b819b21f35a6a3c8548e25c519323caf17c0fea04efd03a4116ef2a8d4036c3788c51553ba7045f2ec6c5c9adf534831f07f16111a8a142d5ab28205
SSDEEP

6144:iDzDSWsuWBjDbzcEXDmm2pcITwhoner+zP308sq+0cUkV8lQnr3Z5n19YzpYmZj:iDXSfDUkmm2px3NgqUUkV8lqp162mZj

Score

10^/10

ssload loader

Malware Config

Signatures

SSLoad
SSLoad Unpacked DLL payload.
loader ssload

Detects SSLoad Unpacked payload 1 IoCs

loader

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\5795410910065270241\e99c79bc77c3b9679a974cbb9fd4fe2a952c675f56a05503b505b24304ba23ba.exe	family_ssload

Executes dropped EXE 1 IoCs

Processes:

e99c79bc77c3b9679a974cbb9fd4fe2a952c675f56a05503b505b24304ba23ba.exe

pid process

2912 e99c79bc77c3b9679a974cbb9fd4fe2a952c675f56a05503b505b24304ba23ba.exe

pid	process
2912	e99c79bc77c3b9679a974cbb9fd4fe2a952c675f56a05503b505b24304ba23ba.exe

Loads dropped DLL 2 IoCs

Processes:

e99c79bc77c3b9679a974cbb9fd4fe2a952c675f56a05503b505b24304ba23ba.exe

pid	process
2240	e99c79bc77c3b9679a974cbb9fd4fe2a952c675f56a05503b505b24304ba23ba.exe
2240	e99c79bc77c3b9679a974cbb9fd4fe2a952c675f56a05503b505b24304ba23ba.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 api.ipify.org
3 api.ipify.org
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
2	api.ipify.org
3	api.ipify.org

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e99c79bc77c3b9679a974cbb9fd4fe2a952c675f56a05503b505b24304ba23ba.exe

description	pid	process	target process
PID 2240 wrote to memory of 2912	2240	e99c79bc77c3b9679a974cbb9fd4fe2a952c675f56a05503b505b24304ba23ba.exe	e99c79bc77c3b9679a974cbb9fd4fe2a952c675f56a05503b505b24304ba23ba.exe
PID 2240 wrote to memory of 2912	2240	e99c79bc77c3b9679a974cbb9fd4fe2a952c675f56a05503b505b24304ba23ba.exe	e99c79bc77c3b9679a974cbb9fd4fe2a952c675f56a05503b505b24304ba23ba.exe
PID 2240 wrote to memory of 2912	2240	e99c79bc77c3b9679a974cbb9fd4fe2a952c675f56a05503b505b24304ba23ba.exe	e99c79bc77c3b9679a974cbb9fd4fe2a952c675f56a05503b505b24304ba23ba.exe
PID 2240 wrote to memory of 2912	2240	e99c79bc77c3b9679a974cbb9fd4fe2a952c675f56a05503b505b24304ba23ba.exe	e99c79bc77c3b9679a974cbb9fd4fe2a952c675f56a05503b505b24304ba23ba.exe

C:\Users\Admin\AppData\Local\Temp\e99c79bc77c3b9679a974cbb9fd4fe2a952c675f56a05503b505b24304ba23ba.exe
"C:\Users\Admin\AppData\Local\Temp\e99c79bc77c3b9679a974cbb9fd4fe2a952c675f56a05503b505b24304ba23ba.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2240

C:\Users\Admin\AppData\Local\Temp\5795410910065270241\e99c79bc77c3b9679a974cbb9fd4fe2a952c675f56a05503b505b24304ba23ba.exe
"C:\Users\Admin\AppData\Local\Temp\5795410910065270241\e99c79bc77c3b9679a974cbb9fd4fe2a952c675f56a05503b505b24304ba23ba.exe"
2⤵
- Executes dropped EXE
PID:2912

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\5795410910065270241\e99c79bc77c3b9679a974cbb9fd4fe2a952c675f56a05503b505b24304ba23ba.exe
Filesize
408KB

MD5
d98749205fff0909e335b5eeb1378973

SHA1
927e94563e873026f5a3964fee8b008c9ad84b7b

SHA256
e99c79bc77c3b9679a974cbb9fd4fe2a952c675f56a05503b505b24304ba23ba

SHA512
c635fe74b819b21f35a6a3c8548e25c519323caf17c0fea04efd03a4116ef2a8d4036c3788c51553ba7045f2ec6c5c9adf534831f07f16111a8a142d5ab28205

Download Submit