5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe
Size

318KB
MD5

46e978f5dee2d39687269d77e44df3cf
SHA1

f15c27a41a2e7e78b07df29c687da3e70e813e66
SHA256

5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d
SHA512

81c38dd8ed41e0fc6b8a83ea536ca568c10cf1ee994edd0ef2acd00e85f45db85830f68e78e28679036d6e950617e4405e1a24fb293bf3e8fabc885f92ca9d19
SSDEEP

6144:A9X0GAbjQDWEofo891UrIq5ezWQn1SGse/yuIW7Nrw0zRRb4iUH13T:G0t/voK1UwzWQ13setIWRw0NZlo13T

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
2272	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe
2272	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe
2272	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe
2272	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\overanalysis\Nonmercenaries39.ini	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe
File opened for modification	C:\Windows\Fonts\Anthidium.Sel114	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2828	2272	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2828	2272	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe	29
PID 2272 wrote to memory of 2828	2272	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe	29
PID 2272 wrote to memory of 2828	2272	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe	29
PID 2272 wrote to memory of 2828	2272	5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe	29

C:\Users\Admin\AppData\Local\Temp\5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe
"C:\Users\Admin\AppData\Local\Temp\5828d4217d31c59b79df8a93b0a52332d4d3ef267f02c2448c463338e017f48d.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 528
  2⤵
  - Program crash
  PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Desktop\polres.lnk

Filesize
1KB

MD5
1de8dc1b6a186bcdccd672ba55e709f6

SHA1
0764615ae02b1b44601cd99a04f7f24ea92ef1e4

SHA256
caeac4e60fb03f2d0a40a7877a4b47ec5c039f6933d0df02a8e8ba33c70e976a

SHA512
52eafa69eb3a76a825897dbcc97f91e552a08c6216907627c4d90ebdafdfd914ddcb196cf83081460aa746dabed167eba69c0576ecc81e78b755f59bc634811d

Download Submit
\Users\Admin\AppData\Local\Temp\nsd12D6.tmp\System.dll

Filesize
11KB

MD5
4ca4fd3fbefa2f6e87e6e9ee87d1c0b3

SHA1
7cdbeb5ff2b14b86af04e075d0ca651183ea5df4

SHA256
d09a8b3ade4ba4b7292c0b3da1bcb4b6c6e2012e0ccfd5e029a54af73a9e1b57

SHA512
cf0f415a97fdc74568297fed4f1295d0d2aef487a308141144ef8d5f04c669ef4795c273e745b81065429adde113fcdedf4c22717a7aeef60fdcd8d4d46f97f8

Download Submit
\Users\Admin\AppData\Local\Temp\nsd12D6.tmp\UserInfo.dll

Filesize
4KB

MD5
035bdb470a6807313bd005bd98341ffc

SHA1
5017d1e5a23f1c64594f737e6fccd519729c3b3e

SHA256
26fa900e3426b4dd272707e1aaf428b5ee06bdc2cc2bbaecdab6b54f11f38f27

SHA512
f888baed5267b05b13722e839634254393aa99b2adf1a2ae6e799d3a901665e7ebda0fa1202db20a6765a8aff58e2ed6f4e822028be426db732eb10ec783aa05

Download Submit
\Users\Admin\AppData\Local\Temp\nsd12D6.tmp\nsDialogs.dll

Filesize
9KB

MD5
eb2c74e05b30b29887b3219f4ea3fdab

SHA1
91173d46b34e7bae57acabdbd239111b5bcc4d9e

SHA256
d253ca5aba34b925796777893f114cc741b015af7868022ab1db2341288c55ed

SHA512
1bb035260223ec585170f891c2624b9ae98671f225e74b913b40bb77b66e3b9c2016037bc8e4b0ae16367d82590a60a0a3bd95d05139ea2454f02020d1b54dae

Download Submit
memory/2272-380-0x00000000056C0000-0x000000000833F000-memory.dmp

Filesize
44.5MB

Download
memory/2272-381-0x00000000056C0000-0x000000000833F000-memory.dmp

Filesize
44.5MB

Download