92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649

Analysis

max time kernel
40s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe
Size

326KB
MD5

813b27000f6d14feeed80b3c79f6f315
SHA1

6983f661dd24a415cef35cad7f630e3dc394e574
SHA256

92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649
SHA512

f6a7f7371da6c3523a6813fa4c4a22627d8491cb86012a9406ffa46211353215836851934e2831508e252d8a6a475e2665dda76948c62e43f05777f274e56fcd
SSDEEP

6144:A9X0GAbjQDWx8o891Ulavtj7IB+VzvI9E4GM5bVbYd2aNk49IAnmmh13M:G0t/ioK1UlEFa+lvgEQbncmM13M

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

Processes:

92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe

pid	process
1280	92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe
1280	92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe
1280	92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe
1280	92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe

Drops file in Windows directory 2 IoCs

Processes:

92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe

description	ioc	process
File opened for modification	C:\Windows\resources\0409\overanalysis\Nonmercenaries39.ini	92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe
File opened for modification	C:\Windows\Fonts\Anthidium.Sel114	92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe
"C:\Users\Admin\AppData\Local\Temp\92524015b7bd4c4b9a4489f1a3815dc8abdf6fdc1cf8294a8a1ca7c57c38f649.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Desktop\polres.lnk

Filesize
1KB

MD5
91267ffd1bad221304a6002112290ca5

SHA1
2e34d896db674c51e790e4babdcadeeef9a1d630

SHA256
8206eeee1a58c435862fa85b1436f61571bce4c582b0c3e417647485ad15ecd6

SHA512
045f6934787bc790cbedd881e90d2312a88d55170cf6fc4b6e7415348003968da97b4df9d398da2db0d8dac8b756be30e71593fd011c7fd66863f3df0792ac4d

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1288.tmp\System.dll

Filesize
11KB

MD5
4ca4fd3fbefa2f6e87e6e9ee87d1c0b3

SHA1
7cdbeb5ff2b14b86af04e075d0ca651183ea5df4

SHA256
d09a8b3ade4ba4b7292c0b3da1bcb4b6c6e2012e0ccfd5e029a54af73a9e1b57

SHA512
cf0f415a97fdc74568297fed4f1295d0d2aef487a308141144ef8d5f04c669ef4795c273e745b81065429adde113fcdedf4c22717a7aeef60fdcd8d4d46f97f8

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1288.tmp\UserInfo.dll

Filesize
4KB

MD5
035bdb470a6807313bd005bd98341ffc

SHA1
5017d1e5a23f1c64594f737e6fccd519729c3b3e

SHA256
26fa900e3426b4dd272707e1aaf428b5ee06bdc2cc2bbaecdab6b54f11f38f27

SHA512
f888baed5267b05b13722e839634254393aa99b2adf1a2ae6e799d3a901665e7ebda0fa1202db20a6765a8aff58e2ed6f4e822028be426db732eb10ec783aa05

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1288.tmp\nsDialogs.dll

Filesize
9KB

MD5
eb2c74e05b30b29887b3219f4ea3fdab

SHA1
91173d46b34e7bae57acabdbd239111b5bcc4d9e

SHA256
d253ca5aba34b925796777893f114cc741b015af7868022ab1db2341288c55ed

SHA512
1bb035260223ec585170f891c2624b9ae98671f225e74b913b40bb77b66e3b9c2016037bc8e4b0ae16367d82590a60a0a3bd95d05139ea2454f02020d1b54dae

Download Submit