c26d121b096af68fc785a4e7fbd821c0c63a64abd2a64c9abf237fe98d0ddf42

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c26d121b096af68fc785a4e7fbd821c0c63a64abd2a64c9abf237fe98d0ddf42.exe
Size

495KB
MD5

672127d627b0d1ffdc8f4f6a7f6a4697
SHA1

965c08f135e270201ca61122955104c0de39ad9f
SHA256

c26d121b096af68fc785a4e7fbd821c0c63a64abd2a64c9abf237fe98d0ddf42
SHA512

f3e6c7837c767944d7e14cac75e5844fa217cfdc3d6dcae575a7d0ad2740617cce9e53e6b28f947114708361570972150737c9c1e3663b5b3ee9fd55a2d6a746
SSDEEP

12288:Pbm37Owct5ERd1ZRad1I5eA2bZxeyCNNrmj:Pbms5EP1CAsZxse

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

c26d121b096af68fc785a4e7fbd821c0c63a64abd2a64c9abf237fe98d0ddf42.exe

pid	process
1760	c26d121b096af68fc785a4e7fbd821c0c63a64abd2a64c9abf237fe98d0ddf42.exe
1760	c26d121b096af68fc785a4e7fbd821c0c63a64abd2a64c9abf237fe98d0ddf42.exe

Drops file in Windows directory 1 IoCs

Processes:

c26d121b096af68fc785a4e7fbd821c0c63a64abd2a64c9abf237fe98d0ddf42.exe

description	ioc	process
File opened for modification	C:\Windows\Fonts\Apoplektikerens\Chateaubriand.Exi	c26d121b096af68fc785a4e7fbd821c0c63a64abd2a64c9abf237fe98d0ddf42.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

848 1760 WerFault.exe c26d121b096af68fc785a4e7fbd821c0c63a64abd2a64c9abf237fe98d0ddf42.exe

pid	pid_target	process	target process
848	1760	WerFault.exe	c26d121b096af68fc785a4e7fbd821c0c63a64abd2a64c9abf237fe98d0ddf42.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c26d121b096af68fc785a4e7fbd821c0c63a64abd2a64c9abf237fe98d0ddf42.exe

description	pid	process	target process
PID 1760 wrote to memory of 848	1760	c26d121b096af68fc785a4e7fbd821c0c63a64abd2a64c9abf237fe98d0ddf42.exe	WerFault.exe
PID 1760 wrote to memory of 848	1760	c26d121b096af68fc785a4e7fbd821c0c63a64abd2a64c9abf237fe98d0ddf42.exe	WerFault.exe
PID 1760 wrote to memory of 848	1760	c26d121b096af68fc785a4e7fbd821c0c63a64abd2a64c9abf237fe98d0ddf42.exe	WerFault.exe
PID 1760 wrote to memory of 848	1760	c26d121b096af68fc785a4e7fbd821c0c63a64abd2a64c9abf237fe98d0ddf42.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c26d121b096af68fc785a4e7fbd821c0c63a64abd2a64c9abf237fe98d0ddf42.exe
"C:\Users\Admin\AppData\Local\Temp\c26d121b096af68fc785a4e7fbd821c0c63a64abd2a64c9abf237fe98d0ddf42.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 536
2⤵
- Program crash
PID:848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsd7F01.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd803D.tmp

Filesize
14B

MD5
67bb7ef976d4ce39058a22b6174a0e72

SHA1
9be7c1328a129dfa8fbda22b646e803ff262c5ef

SHA256
97e5daf6f20df9ce038a539d8bcf4d7b9efc1058102c9ce7ce1e6e169200672c

SHA512
12192b1718b77b437b383bca40335944b6bcaa772ccd398eb4b92a5b7882e3159a65470141fb98d7911f96bd97d46e93955302a9f5a19059ebcaa2c1a3f915e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj7F22.tmp

Filesize
52B

MD5
5d04a35d3950677049c7a0cf17e37125

SHA1
cafdd49a953864f83d387774b39b2657a253470f

SHA256
a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266

SHA512
c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso7F42.tmp

Filesize
3B

MD5
4e27f2226785e9abbe046fc592668860

SHA1
28b18a7f383131df509f7191f946a32c5a2e410c

SHA256
01a219245e1501fee01ce0baea8f6065ce5162cea12fa570689a07c9717be81d

SHA512
2a23585835bdb5db8175cab265566042282841efdcee8aaba8b9b5d466b0f165c0c5973033ce94bb9a8f07a956689247981ea07ac5a51408263e1653d9710adb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso7F42.tmp

Filesize
35B

MD5
0a15a1cc00e8d354105a0626c45e8220

SHA1
b0177009807b5763762e990f9a7a071ddbc32bf1

SHA256
3dbc268440f48109fa998982c07c49657c5625d93ec281f0754721e06988c2f0

SHA512
e57dfa2480c15950e16f3b21efcbf2b3f793db0fd2e29de029f5281c36de94d4a965c8a185df188c83532008f67f236e42d860321349202fd13494967cc65d89

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso7F42.tmp

Filesize
60B

MD5
6905490802a6c440fab7bc3299682016

SHA1
7212e3db4f3387c8ff2daee9a94067db11a218be

SHA256
0fc3d8084bd0470747f5e0ecb10127bbf64b1b7618ab5a819db38e4b839d3451

SHA512
fcf7b1927605f76bd61d0f5c467b040f210d37ae99477f1a1984cc84037c2b7b461c668e1ba993dcb4e9393c2c7a16ac2b42ba2e97d4e18121ba18d800a04a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst7FFE.tmp

Filesize
56B

MD5
2c77bbd52333e4144ba070082eac42d6

SHA1
d5570ca72f198bd75e1f0d241f0dd69986877ea4

SHA256
54695e5022b16a8b57b4995eabb2d2b2212e0f3fc6ddad15cb2bbc5798fa3c04

SHA512
c800b128aee9e19cfa614be129deed3a440263ff5b58d801e4929ceebf5a930eba8efe948c70e163294a4dabe993a6dcc24f3ca3cef859877da852919dce4162

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy7E93.tmp

Filesize
74B

MD5
16d513397f3c1f8334e8f3e4fc49828f

SHA1
4ee15afca81ca6a13af4e38240099b730d6931f0

SHA256
d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36

SHA512
4a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy7E93.tmp

Filesize
61B

MD5
74b3a93cf5d11d11b8dff1d5ec57a81d

SHA1
bc7da5a65649e99c488e6a4c130f1134e80dcf74

SHA256
706dc879eaaeee6ada053cfd98acedee299c07a8dc98f0cc024cc614057c38b6

SHA512
bef3b9fa70eec9ecb57ccc75bb54a5a76e1a0c4a8387823f7c931f091a1157bea4e678e19fcc775a7ee1c43d025d09e8ae4869b4c785dc7f8c4de39cf9bd7d82

Download Submit