e3b090f044833c0e9328593357138a307bcf2ce0ab4badc3fd766b83beb4af1b

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 01:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e3b090f044833c0e9328593357138a307bcf2ce0ab4badc3fd766b83beb4af1b.exe
Size

332KB
MD5

93ed4d71925bf64cc42cc9dd295d0394
SHA1

bb1feb06a69b108e103435bb5b498aab3c7315af
SHA256

e3b090f044833c0e9328593357138a307bcf2ce0ab4badc3fd766b83beb4af1b
SHA512

88a9d09fd2ba60f051bc86bf4c7dad87acbca6348e7380e21d635665aeaf7231842a7bd5f2b729bc93221bd6aa391e893f6f53d2c575aeadf512617b0d423f8e
SSDEEP

6144:EYa6EIIIIBDs7abo+8dlqp5PhyOH+lMkMPHTEJp7eOm9t1t7N1e:EYCw+bl5ZyOelMLLEJE19tP7N4

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1612	e3b090f044833c0e9328593357138a307bcf2ce0ab4badc3fd766b83beb4af1b.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	drive.google.com
3	drive.google.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1612	e3b090f044833c0e9328593357138a307bcf2ce0ab4badc3fd766b83beb4af1b.exe
2096	e3b090f044833c0e9328593357138a307bcf2ce0ab4badc3fd766b83beb4af1b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1612 set thread context of 2096	1612	e3b090f044833c0e9328593357138a307bcf2ce0ab4badc3fd766b83beb4af1b.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1612	e3b090f044833c0e9328593357138a307bcf2ce0ab4badc3fd766b83beb4af1b.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2096	1612	e3b090f044833c0e9328593357138a307bcf2ce0ab4badc3fd766b83beb4af1b.exe	30
PID 1612 wrote to memory of 2096	1612	e3b090f044833c0e9328593357138a307bcf2ce0ab4badc3fd766b83beb4af1b.exe	30
PID 1612 wrote to memory of 2096	1612	e3b090f044833c0e9328593357138a307bcf2ce0ab4badc3fd766b83beb4af1b.exe	30
PID 1612 wrote to memory of 2096	1612	e3b090f044833c0e9328593357138a307bcf2ce0ab4badc3fd766b83beb4af1b.exe	30
PID 1612 wrote to memory of 2096	1612	e3b090f044833c0e9328593357138a307bcf2ce0ab4badc3fd766b83beb4af1b.exe	30
PID 1612 wrote to memory of 2096	1612	e3b090f044833c0e9328593357138a307bcf2ce0ab4badc3fd766b83beb4af1b.exe	30

C:\Users\Admin\AppData\Local\Temp\e3b090f044833c0e9328593357138a307bcf2ce0ab4badc3fd766b83beb4af1b.exe
"C:\Users\Admin\AppData\Local\Temp\e3b090f044833c0e9328593357138a307bcf2ce0ab4badc3fd766b83beb4af1b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Users\Admin\AppData\Local\Temp\e3b090f044833c0e9328593357138a307bcf2ce0ab4badc3fd766b83beb4af1b.exe
  "C:\Users\Admin\AppData\Local\Temp\e3b090f044833c0e9328593357138a307bcf2ce0ab4badc3fd766b83beb4af1b.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nst9B67.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
memory/1612-8-0x0000000076E31000-0x0000000076F32000-memory.dmp

Filesize
1.0MB

Download
memory/1612-9-0x0000000076E30000-0x0000000076FD9000-memory.dmp

Filesize
1.7MB

Download
memory/2096-10-0x0000000076E30000-0x0000000076FD9000-memory.dmp

Filesize
1.7MB

Download
memory/2096-21-0x0000000000470000-0x00000000014D2000-memory.dmp

Filesize
16.4MB

Download