b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5

Analysis

max time kernel
33s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5.exe
Size 322KB
Sample240523-sd5jpsfb5y
SHA256 b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5
MD5 86a0fbc943d577f93faf00394997bb22
SHA1 bc1bd20d88ce7f659dbab2752d670f8cce3ff8e3
SHA512 c047b8a78a8513fa37a4147d45dfe92c3534693ab5394ee96d50090d71cd28097da09b409e4d00c0e5d6ef1451d29119156c80bd227d7eb5172ea8c7c3713c72
SSDEEP 6144:A9X0GAbjQDWloo891UylPBX6xuY6RzWBw39tASqEHSVI9AWKw133:G0t/looK1UABXTUI9/Kw133
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
1600	b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5.exe
1600	b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5.exe
1600	b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5.exe
1600	b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\overanalysis\Nonmercenaries39.ini	b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5.exe
File opened for modification	C:\Windows\Fonts\Anthidium.Sel114	b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5.exe
"C:\Users\Admin\AppData\Local\Temp\b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

polres.lnk

Path C:\Users\Public\Desktop\polres.lnk
Size 1KB
SHA256 8208dc14fb8e8b9e1057e5e0b50df516f48af8b3910e18594736bd304b626387
MD5 8594d27ecbad052133e1b33ae743116b
SHA1 421ddafc15d1b48fb9aeb61fac3b11c6e34937ad
SHA512 2bceb8b101a5bcab87f9297744d1b8da9ac95ccc65265e539ee11949defdc723b875a52dbe9da04512ce7409d744d2bef49aec7980853c940bab5f69096d2733
MD5 SHA1 SHA512

Submit Download

System.dll

Path \Users\Admin\AppData\Local\Temp\nsd2398.tmp\System.dll
Size 11KB
SHA256 d09a8b3ade4ba4b7292c0b3da1bcb4b6c6e2012e0ccfd5e029a54af73a9e1b57
MD5 4ca4fd3fbefa2f6e87e6e9ee87d1c0b3
SHA1 7cdbeb5ff2b14b86af04e075d0ca651183ea5df4
SHA512 cf0f415a97fdc74568297fed4f1295d0d2aef487a308141144ef8d5f04c669ef4795c273e745b81065429adde113fcdedf4c22717a7aeef60fdcd8d4d46f97f8
SSDEEP 192:EPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4W:j7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

Submit Download

UserInfo.dll

Path \Users\Admin\AppData\Local\Temp\nsd2398.tmp\UserInfo.dll
Size 4KB
SHA256 26fa900e3426b4dd272707e1aaf428b5ee06bdc2cc2bbaecdab6b54f11f38f27
MD5 035bdb470a6807313bd005bd98341ffc
SHA1 5017d1e5a23f1c64594f737e6fccd519729c3b3e
SHA512 f888baed5267b05b13722e839634254393aa99b2adf1a2ae6e799d3a901665e7ebda0fa1202db20a6765a8aff58e2ed6f4e822028be426db732eb10ec783aa05
MD5 SHA1 SHA512

Submit Download

nsDialogs.dll

Path \Users\Admin\AppData\Local\Temp\nsd2398.tmp\nsDialogs.dll
Size 9KB
SHA256 d253ca5aba34b925796777893f114cc741b015af7868022ab1db2341288c55ed
MD5 eb2c74e05b30b29887b3219f4ea3fdab
SHA1 91173d46b34e7bae57acabdbd239111b5bcc4d9e
SHA512 1bb035260223ec585170f891c2624b9ae98671f225e74b913b40bb77b66e3b9c2016037bc8e4b0ae16367d82590a60a0a3bd95d05139ea2454f02020d1b54dae
SSDEEP 96:oVDlD3cd51V1zL7xqEscxM2DjDf3GEst+Nt+jvcx488qndYv0PLE:oVp34z/x3sREskpxjdO0PLE
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1600-380-0x0000000005650000-0x0000000006CBD000-memory.dmp

Download

memory/1600-381-0x0000000005650000-0x0000000006CBD000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads