b400ce3556aa6dc0ee29370eafb82fde2f8a64231e06b676b3ab1841d59cbeb2

Analysis

max time kernel
139s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 21:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91-51974771699348-NR.exe
Size

639KB
MD5

25239e2f487056e018c2b93679c9c218
SHA1

2861869385862a7b2578bd140392b9e0691af911
SHA256

7408fdd8598dc6e3c61ba4d6029c032c20ac550f1d4798d04a9e62ab32e21be5
SHA512

3a04d83549ff419a5171d78e033a5fe71e5e0e4a09586222404c39e5f9ef0dcdae03a339d401cf7d1e36aed93f10513f245eeaa5a34440c044ac5c4f19a976ba
SSDEEP

12288:ow5jalVUuAOpM6qDy9CSl7bsfZTjaI/WQTT9U3W0/Fg0oDmfd0FNgI0bx:owEppqD2BY4mNDmfUf0

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

91-51974771699348-NR.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 91-51974771699348-NR.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

91-51974771699348-NR.exe

pid process

3184 91-51974771699348-NR.exe
3184 91-51974771699348-NR.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	91-51974771699348-NR.exe

pid	process
3184	91-51974771699348-NR.exe
3184	91-51974771699348-NR.exe

C:\Users\Admin\AppData\Local\Temp\91-51974771699348-NR.exe
"C:\Users\Admin\AppData\Local\Temp\91-51974771699348-NR.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3184-3-0x0000000000401000-0x000000000049D000-memory.dmp

Filesize
624KB

Download
memory/3184-0-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3184-2-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Filesize
4KB

Download
memory/3184-1-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Filesize
4KB

Download
memory/3184-4-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3184-5-0x0000000000401000-0x000000000049D000-memory.dmp

Filesize
624KB

Download