542c2e1064be8cd8393602f63b793e9d34eb81b1090a3c80623777f17fa25c6c

Resubmissions

13/05/2024, 06:03

240513-gr1l5aab9y10

12/05/2024, 20:11

240512-yymsaaec2w10

Analysis

max time kernel
458s
max time network
460s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
12/05/2024, 20:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NoEscape.exe/NoEscape.exe-Latest Version/vc_redist.x86.exe
Size 13.1MB
Sample240512-yymsaaec2w
SHA256 fdd1e1f0dcae2d0aa0720895eff33b927d13076e64464bb7c7e5843b7667cd14
MD5 1a15e6606bac9647e7ad3caa543377cf
SHA1 bfb74e498c44d3a103ca3aa2831763fb417134d1
SHA512 e8cb67fc8e0312da3cc98364b96dfa1a63150ab9de60069c4af60c1cf77d440b7dffe630b4784ba07ea9bf146bdbf6ad5282a900ffd6ab7d86433456a752b2fd
SSDEEP 393216:S1RPq5dCsKSR65cX7Eyd/qnejOFxP7OEnl4L/Vvc:yP5iw56oyleej2OEnlwc
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1932	vc_redist.x86.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 1932	4248	vc_redist.x86.exe	79
PID 4248 wrote to memory of 1932	4248	vc_redist.x86.exe	79
PID 4248 wrote to memory of 1932	4248	vc_redist.x86.exe	79

C:\Users\Admin\AppData\Local\Temp\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe
"C:\Users\Admin\AppData\Local\Temp\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Users\Admin\AppData\Local\Temp\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe
  "C:\Users\Admin\AppData\Local\Temp\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe" -burn.unelevated BurnPipe.{C95A5C9C-B3C2-4817-987F-D4AF8E33BE70} {C12F64A4-12E0-45D0-A370-0BFE9E40CB4A} 4248
  2⤵
  - Loads dropped DLL
  PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logo.png

Path C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba1\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
MD5 SHA1 SHA512

Submit Download

wixstdba.dll

Path C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba1\wixstdba.dll
Size 118KB
SHA256 a9295ad4e909f979e2b6cb2b2495c3d35c8517e689cd64a918c690e17b49078b
MD5 4d20a950a3571d11236482754b4a8e76
SHA1 e68bd784ac143e206d52ecaf54a7e3b8d4d75c9c
SHA512 8b9243d1f9edbcbd6bdaf6874dc69c806bb29e909bd733781fde8ac80ca3fff574d786ca903871d1e856e73fd58403bebb58c9f23083ea7cd749ba3e890af3d2
SSDEEP 1536:nw7WzpopAuJhsVuThs5cXyeM6JUOfPGSpeBxm946ITADDwYkH/1d9chyP7iN6p:pmAuJhAyZFpem90iw//1d9chwG6
MD5 SHA1 SHA512 SSDEEP