Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    22-05-2024 15:01

General

  • Target

    Signatureformrequest#54526.com.exe

  • Size

    380KB

  • MD5

    5670f42a9ed9c593b72fdf7351cd5e6c

  • SHA1

    781615f55566cd8f5442b6bf7e065ab7cea1b902

  • SHA256

    86acf99a01780d400bcf8429879d515401ec2dfb15554ce91dc95ee5494508d6

  • SHA512

    ace933955f63a7f7a0fd873907992371f6f36304b78bf12fe47f7046162f97a6b0cae082e1c354d9ada1ad6e631f1fcc1b26ad44e987a8a334f6b37e8e5d3f38

  • SSDEEP

    6144:cM231sHcuulI7ph/+nA3feUHzXclMIXuLQwidBSGYFuXSjLat:UecuuAph/IAFzXhdLspY/U

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\Signatureformrequest#54526.com.exe
    "C:\Users\Admin\AppData\Local\Temp\Signatureformrequest#54526.com.exe"
    1⤵
    • Loads dropped DLL
    PID:1780

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Tubaistens.ini

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • \Users\Admin\AppData\Local\Temp\nsi1788.tmp\System.dll

    Filesize

    11KB

    MD5

    e23600029d1b09bdb1d422fb4e46f5a6

    SHA1

    5d64a2f6a257a98a689a3db9a087a0fd5f180096

    SHA256

    7342b73593b3aa1b15e3731bfb1afd1961802a5c66343bac9a2c737ee94f4e38

    SHA512

    c971f513142633ce0e6ec6a04c754a286da8016563dab368c3fac83aef81fa3e9df1003c4b63d00a46351a9d18eaa7ae7645caef172e5e1d6e29123ab864e7ac

  • memory/1780-26216-0x0000000013D40000-0x0000000016D75000-memory.dmp

    Filesize

    48.2MB

  • memory/1780-26217-0x0000000013D40000-0x0000000016D75000-memory.dmp

    Filesize

    48.2MB