b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5

Analysis

max time kernel
30s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5.exe
Size

322KB
MD5

86a0fbc943d577f93faf00394997bb22
SHA1

bc1bd20d88ce7f659dbab2752d670f8cce3ff8e3
SHA256

b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5
SHA512

c047b8a78a8513fa37a4147d45dfe92c3534693ab5394ee96d50090d71cd28097da09b409e4d00c0e5d6ef1451d29119156c80bd227d7eb5172ea8c7c3713c72
SSDEEP

6144:A9X0GAbjQDWloo891UylPBX6xuY6RzWBw39tASqEHSVI9AWKw133:G0t/looK1UABXTUI9/Kw133

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

Processes:

b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5.exe

pid	process
2576	b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5.exe
2576	b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5.exe
2576	b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5.exe
2576	b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5.exe

Drops file in Windows directory 2 IoCs

Processes:

b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5.exe

description	ioc	process
File opened for modification	C:\Windows\resources\0409\overanalysis\Nonmercenaries39.ini	b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5.exe
File opened for modification	C:\Windows\Fonts\Anthidium.Sel114	b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5.exe
"C:\Users\Admin\AppData\Local\Temp\b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2576

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Desktop\polres.lnk
Filesize
1KB

MD5
58a8e42ba90478af0f582be837328d48

SHA1
a7097e647e8fc0ef473c38b581736b15b119684d

SHA256
6c6b522a2522128e7beb90c6abaa0b1139aba0a57688e61d1dcba0e326f10b30

SHA512
0ab62019e03579a21bfffa1f4792df40f2b3233285949c7f4b587a6c600faddf5fc8ede068fb3fd41961825e3eed8c833b6a73d5c28f790fd84577d0935e4462

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1B5E.tmp\System.dll
Filesize
11KB

MD5
4ca4fd3fbefa2f6e87e6e9ee87d1c0b3

SHA1
7cdbeb5ff2b14b86af04e075d0ca651183ea5df4

SHA256
d09a8b3ade4ba4b7292c0b3da1bcb4b6c6e2012e0ccfd5e029a54af73a9e1b57

SHA512
cf0f415a97fdc74568297fed4f1295d0d2aef487a308141144ef8d5f04c669ef4795c273e745b81065429adde113fcdedf4c22717a7aeef60fdcd8d4d46f97f8

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1B5E.tmp\UserInfo.dll
Filesize
4KB

MD5
035bdb470a6807313bd005bd98341ffc

SHA1
5017d1e5a23f1c64594f737e6fccd519729c3b3e

SHA256
26fa900e3426b4dd272707e1aaf428b5ee06bdc2cc2bbaecdab6b54f11f38f27

SHA512
f888baed5267b05b13722e839634254393aa99b2adf1a2ae6e799d3a901665e7ebda0fa1202db20a6765a8aff58e2ed6f4e822028be426db732eb10ec783aa05

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1B5E.tmp\nsDialogs.dll
Filesize
9KB

MD5
eb2c74e05b30b29887b3219f4ea3fdab

SHA1
91173d46b34e7bae57acabdbd239111b5bcc4d9e

SHA256
d253ca5aba34b925796777893f114cc741b015af7868022ab1db2341288c55ed

SHA512
1bb035260223ec585170f891c2624b9ae98671f225e74b913b40bb77b66e3b9c2016037bc8e4b0ae16367d82590a60a0a3bd95d05139ea2454f02020d1b54dae

Download Submit
memory/2576-380-0x0000000005520000-0x0000000006B8D000-memory.dmp

Filesize
22.4MB

Download
memory/2576-381-0x0000000005520000-0x0000000006B8D000-memory.dmp

Filesize
22.4MB

Download