Analysis

  • max time kernel
    22s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    22-05-2024 18:10

General

  • Target

    PO874530040021 YIKANG INQUIRY.com.exe

  • Size

    322KB

  • MD5

    86a0fbc943d577f93faf00394997bb22

  • SHA1

    bc1bd20d88ce7f659dbab2752d670f8cce3ff8e3

  • SHA256

    b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5

  • SHA512

    c047b8a78a8513fa37a4147d45dfe92c3534693ab5394ee96d50090d71cd28097da09b409e4d00c0e5d6ef1451d29119156c80bd227d7eb5172ea8c7c3713c72

  • SSDEEP

    6144:A9X0GAbjQDWloo891UylPBX6xuY6RzWBw39tASqEHSVI9AWKw133:G0t/looK1UABXTUI9/Kw133

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 4 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\PO874530040021 YIKANG INQUIRY.com.exe
    "C:\Users\Admin\AppData\Local\Temp\PO874530040021 YIKANG INQUIRY.com.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    PID:1308

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Public\Desktop\polres.lnk

    Filesize

    1KB

    MD5

    d7383304fa565aaf39be92b5b4927ed5

    SHA1

    45013acc35f206a7e46f67f517d53870b72ffd76

    SHA256

    f47406223f2e209a0a48cca097906c98e3880159764ae100bc92f4344a643801

    SHA512

    cb903de5c8cec33c140dbcf7aa5f61301183113dbd7831c3ad86e81c5bce4de2a255a48c3b3ddbbd41c1fab5881b4cd56476bca3eeb871c80ab280bc5ccc72e7

  • \Users\Admin\AppData\Local\Temp\nst8A56.tmp\System.dll

    Filesize

    11KB

    MD5

    4ca4fd3fbefa2f6e87e6e9ee87d1c0b3

    SHA1

    7cdbeb5ff2b14b86af04e075d0ca651183ea5df4

    SHA256

    d09a8b3ade4ba4b7292c0b3da1bcb4b6c6e2012e0ccfd5e029a54af73a9e1b57

    SHA512

    cf0f415a97fdc74568297fed4f1295d0d2aef487a308141144ef8d5f04c669ef4795c273e745b81065429adde113fcdedf4c22717a7aeef60fdcd8d4d46f97f8

  • \Users\Admin\AppData\Local\Temp\nst8A56.tmp\UserInfo.dll

    Filesize

    4KB

    MD5

    035bdb470a6807313bd005bd98341ffc

    SHA1

    5017d1e5a23f1c64594f737e6fccd519729c3b3e

    SHA256

    26fa900e3426b4dd272707e1aaf428b5ee06bdc2cc2bbaecdab6b54f11f38f27

    SHA512

    f888baed5267b05b13722e839634254393aa99b2adf1a2ae6e799d3a901665e7ebda0fa1202db20a6765a8aff58e2ed6f4e822028be426db732eb10ec783aa05

  • \Users\Admin\AppData\Local\Temp\nst8A56.tmp\nsDialogs.dll

    Filesize

    9KB

    MD5

    eb2c74e05b30b29887b3219f4ea3fdab

    SHA1

    91173d46b34e7bae57acabdbd239111b5bcc4d9e

    SHA256

    d253ca5aba34b925796777893f114cc741b015af7868022ab1db2341288c55ed

    SHA512

    1bb035260223ec585170f891c2624b9ae98671f225e74b913b40bb77b66e3b9c2016037bc8e4b0ae16367d82590a60a0a3bd95d05139ea2454f02020d1b54dae

  • memory/1308-380-0x0000000004EB0000-0x000000000651D000-memory.dmp

    Filesize

    22.4MB

  • memory/1308-381-0x0000000004EB0000-0x000000000651D000-memory.dmp

    Filesize

    22.4MB