e145e51d2851637cdfd9bd4f96fec35a785f91b15a0b42fef07f476205db4530

Analysis

max time kernel
34s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e145e51d2851637cdfd9bd4f96fec35a785f91b15a0b42fef07f476205db4530.exe
Size

320KB
MD5

c4976d8e37740fb3b7c1443f52b7c8dd
SHA1

0ab9131546ab7d2f2ed47928c0c6068c5de2841c
SHA256

e145e51d2851637cdfd9bd4f96fec35a785f91b15a0b42fef07f476205db4530
SHA512

f9fa6392e8cd269dbc14706aab0360f090c0bb8abfdc27c29e18f73f4c16edec0cf4ebdfe913865b7da364dddad341e87ca823a6b452b9e1fbe5e9299aed4bb1
SSDEEP

6144:A9X0GAbjQDWVUo891UHALFlFTwMOG5l+yi3RFRjzL13W:G0t/6oK1UH8lFTeGI3lzL13W

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

Processes:

e145e51d2851637cdfd9bd4f96fec35a785f91b15a0b42fef07f476205db4530.exe

pid	process
2268	e145e51d2851637cdfd9bd4f96fec35a785f91b15a0b42fef07f476205db4530.exe
2268	e145e51d2851637cdfd9bd4f96fec35a785f91b15a0b42fef07f476205db4530.exe
2268	e145e51d2851637cdfd9bd4f96fec35a785f91b15a0b42fef07f476205db4530.exe
2268	e145e51d2851637cdfd9bd4f96fec35a785f91b15a0b42fef07f476205db4530.exe

Drops file in Windows directory 2 IoCs

Processes:

e145e51d2851637cdfd9bd4f96fec35a785f91b15a0b42fef07f476205db4530.exe

description	ioc	process
File opened for modification	C:\Windows\resources\0409\overanalysis\Nonmercenaries39.ini	e145e51d2851637cdfd9bd4f96fec35a785f91b15a0b42fef07f476205db4530.exe
File opened for modification	C:\Windows\Fonts\Anthidium.Sel114	e145e51d2851637cdfd9bd4f96fec35a785f91b15a0b42fef07f476205db4530.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\e145e51d2851637cdfd9bd4f96fec35a785f91b15a0b42fef07f476205db4530.exe
"C:\Users\Admin\AppData\Local\Temp\e145e51d2851637cdfd9bd4f96fec35a785f91b15a0b42fef07f476205db4530.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Desktop\polres.lnk

Filesize
1KB

MD5
d91e78cc883e0eebda0cd4b150ff1cd8

SHA1
fa99e2d5a3238f3db0f174515529b749a6cd2ca4

SHA256
7b449082103f86e1d541fdf505cda4f970bdd609ed19ee5fb83b97e83475c9b5

SHA512
27f1d34576f2aa303d34f94594de79d0937877ebab812a7ef41adc2abe34c7da5b1e3a1bb5beeeb4d4417e4b0bf2615881c5f16292f28442c9aef6ba0857d499

Download Submit
\Users\Admin\AppData\Local\Temp\nso1F93.tmp\System.dll

Filesize
11KB

MD5
4ca4fd3fbefa2f6e87e6e9ee87d1c0b3

SHA1
7cdbeb5ff2b14b86af04e075d0ca651183ea5df4

SHA256
d09a8b3ade4ba4b7292c0b3da1bcb4b6c6e2012e0ccfd5e029a54af73a9e1b57

SHA512
cf0f415a97fdc74568297fed4f1295d0d2aef487a308141144ef8d5f04c669ef4795c273e745b81065429adde113fcdedf4c22717a7aeef60fdcd8d4d46f97f8

Download Submit
\Users\Admin\AppData\Local\Temp\nso1F93.tmp\UserInfo.dll

Filesize
4KB

MD5
035bdb470a6807313bd005bd98341ffc

SHA1
5017d1e5a23f1c64594f737e6fccd519729c3b3e

SHA256
26fa900e3426b4dd272707e1aaf428b5ee06bdc2cc2bbaecdab6b54f11f38f27

SHA512
f888baed5267b05b13722e839634254393aa99b2adf1a2ae6e799d3a901665e7ebda0fa1202db20a6765a8aff58e2ed6f4e822028be426db732eb10ec783aa05

Download Submit
\Users\Admin\AppData\Local\Temp\nso1F93.tmp\nsDialogs.dll

Filesize
9KB

MD5
eb2c74e05b30b29887b3219f4ea3fdab

SHA1
91173d46b34e7bae57acabdbd239111b5bcc4d9e

SHA256
d253ca5aba34b925796777893f114cc741b015af7868022ab1db2341288c55ed

SHA512
1bb035260223ec585170f891c2624b9ae98671f225e74b913b40bb77b66e3b9c2016037bc8e4b0ae16367d82590a60a0a3bd95d05139ea2454f02020d1b54dae

Download Submit