5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe
Size

318KB
MD5

46e978f5dee2d39687269d77e44df3cf
SHA1

f15c27a41a2e7e78b07df29c687da3e70e813e66
SHA256

5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d
SHA512

81c38dd8ed41e0fc6b8a83ea536ca568c10cf1ee994edd0ef2acd00e85f45db85830f68e78e28679036d6e950617e4405e1a24fb293bf3e8fabc885f92ca9d19
SSDEEP

6144:A9X0GAbjQDWEofo891UrIq5ezWQn1SGse/yuIW7Nrw0zRRb4iUH13T:G0t/voK1UwzWQ13setIWRw0NZlo13T

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

Processes:

5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe

pid	process
2992	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe
2992	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe
2992	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe
2992	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe

Drops file in Windows directory 2 IoCs

Processes:

5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe

description	ioc	process
File opened for modification	C:\Windows\resources\0409\overanalysis\Nonmercenaries39.ini	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe
File opened for modification	C:\Windows\Fonts\Anthidium.Sel114	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2488 2992 WerFault.exe 5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe

pid	pid_target	process	target process
2488	2992	WerFault.exe	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe

description	pid	process	target process
PID 2992 wrote to memory of 2488	2992	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe	WerFault.exe
PID 2992 wrote to memory of 2488	2992	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe	WerFault.exe
PID 2992 wrote to memory of 2488	2992	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe	WerFault.exe
PID 2992 wrote to memory of 2488	2992	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe
"C:\Users\Admin\AppData\Local\Temp\5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 524
2⤵
- Program crash
PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Desktop\polres.lnk

Filesize
1KB

MD5
fc8e3b23665f992ed82424ddfbde44ed

SHA1
7079811016e86e03f1732d584d09603ef55c38a3

SHA256
44fe45f9418d558b886056d4ba79059c9c55a6ab0ebafdc71322656b6ae20430

SHA512
051adc5d75e1450e314610ecbc7339a23a211c2970b7d67be637b9eff15b2d781d91366e44d809eca7b26007f923e7d02c71909c049867a4812ece6bb7b58056

Download Submit
\Users\Admin\AppData\Local\Temp\nsd26A4.tmp\System.dll

Filesize
11KB

MD5
4ca4fd3fbefa2f6e87e6e9ee87d1c0b3

SHA1
7cdbeb5ff2b14b86af04e075d0ca651183ea5df4

SHA256
d09a8b3ade4ba4b7292c0b3da1bcb4b6c6e2012e0ccfd5e029a54af73a9e1b57

SHA512
cf0f415a97fdc74568297fed4f1295d0d2aef487a308141144ef8d5f04c669ef4795c273e745b81065429adde113fcdedf4c22717a7aeef60fdcd8d4d46f97f8

Download Submit
\Users\Admin\AppData\Local\Temp\nsd26A4.tmp\UserInfo.dll

Filesize
4KB

MD5
035bdb470a6807313bd005bd98341ffc

SHA1
5017d1e5a23f1c64594f737e6fccd519729c3b3e

SHA256
26fa900e3426b4dd272707e1aaf428b5ee06bdc2cc2bbaecdab6b54f11f38f27

SHA512
f888baed5267b05b13722e839634254393aa99b2adf1a2ae6e799d3a901665e7ebda0fa1202db20a6765a8aff58e2ed6f4e822028be426db732eb10ec783aa05

Download Submit
\Users\Admin\AppData\Local\Temp\nsd26A4.tmp\nsDialogs.dll

Filesize
9KB

MD5
eb2c74e05b30b29887b3219f4ea3fdab

SHA1
91173d46b34e7bae57acabdbd239111b5bcc4d9e

SHA256
d253ca5aba34b925796777893f114cc741b015af7868022ab1db2341288c55ed

SHA512
1bb035260223ec585170f891c2624b9ae98671f225e74b913b40bb77b66e3b9c2016037bc8e4b0ae16367d82590a60a0a3bd95d05139ea2454f02020d1b54dae

Download Submit
memory/2992-380-0x0000000005620000-0x000000000829F000-memory.dmp

Filesize
44.5MB

Download
memory/2992-381-0x0000000005620000-0x000000000829F000-memory.dmp

Filesize
44.5MB

Download