1c0130a25ef35648b515bf14f3fc16a5628d2d98f7916d7e47e301a461ad31b4

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 04:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c0130a25ef35648b515bf14f3fc16a5628d2d98f7916d7e47e301a461ad31b4.exe
Size

83KB
MD5

05f8e7f4619835138b4cc07c8c2cff30
SHA1

dacefd8ebb6708aa4871a63ce3f4d2ff4d754572
SHA256

1c0130a25ef35648b515bf14f3fc16a5628d2d98f7916d7e47e301a461ad31b4
SHA512

f59a6d285582c743dad0c4c43508615494d73e2b1ae4a926d744eca59aa27640ef5a924f5245768c5d49714897123d7771b51781b566cd07747febfac503eeb4
SSDEEP

1536:sB+FC9RntfWeoGiPyCHjKDjvQQQtUw2dfkoT/y2ZLJFC:sB+F8tfPN4yCDKDjvQQQtV

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2128	budha.exe

Loads dropped DLL 2 IoCs

pid	Process
2176	1c0130a25ef35648b515bf14f3fc16a5628d2d98f7916d7e47e301a461ad31b4.exe
2176	1c0130a25ef35648b515bf14f3fc16a5628d2d98f7916d7e47e301a461ad31b4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2128	2176	1c0130a25ef35648b515bf14f3fc16a5628d2d98f7916d7e47e301a461ad31b4.exe	28
PID 2176 wrote to memory of 2128	2176	1c0130a25ef35648b515bf14f3fc16a5628d2d98f7916d7e47e301a461ad31b4.exe	28
PID 2176 wrote to memory of 2128	2176	1c0130a25ef35648b515bf14f3fc16a5628d2d98f7916d7e47e301a461ad31b4.exe	28
PID 2176 wrote to memory of 2128	2176	1c0130a25ef35648b515bf14f3fc16a5628d2d98f7916d7e47e301a461ad31b4.exe	28

C:\Users\Admin\AppData\Local\Temp\1c0130a25ef35648b515bf14f3fc16a5628d2d98f7916d7e47e301a461ad31b4.exe
"C:\Users\Admin\AppData\Local\Temp\1c0130a25ef35648b515bf14f3fc16a5628d2d98f7916d7e47e301a461ad31b4.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Executes dropped EXE
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
84KB

MD5
8f1576ee3a494cf398f1cbc3b3031d1a

SHA1
58057e80f650093a835cc7acf2fd62faaf891a63

SHA256
2fc3cf757469381676040b56e4b812ee7b3e6beb6fe1861796e259230c6ed8a4

SHA512
5021eddc7b86055870f5683711657e545b6c0e9b5e83a8614c87b9eb513872ffcb28ab43958382dc7dae1947e41ec80dca4c62a7e1aad03609d1e140cfda50fc

Download Submit
memory/2128-15-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2128-16-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2128-17-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2128-19-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2176-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2176-1-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2176-3-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2176-2-0x0000000000409000-0x000000000040A000-memory.dmp

Filesize
4KB

Download
memory/2176-5-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download