5695a75d96e56497ab5f7175d5c1da59a4565df668cb89db774eefbb5bfb6cf5

Resubmissions

05-09-2023 01:34

230905-by5lrsch46 10

Analysis

max time kernel
15s
max time network
34s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e91296156cd506f7a152db4e4beac1c56ce03676f16db637c97cd135038409ff.exe
Size

2.6MB
MD5

838bf9e13202d1ceeac814788efe837b
SHA1

75b46cb896ccb9f3209ce235ebd5f62fb2c35b3d
SHA256

e91296156cd506f7a152db4e4beac1c56ce03676f16db637c97cd135038409ff
SHA512

b75f12b8941843ee4141a017c61001f57f3e016cc5cd9530a0aad7478b4cb38b9fca5d5070e4f7f55417653bc6732db85db996ace60aa3c4f04c3454c6db3410
SSDEEP

49152:HdgDxc28AZaaE5CPuJIurzZuwWToqZsscWVYzRtYxZ7zgCBoL2I2/Re:HocbA0avPuhSToqZsscBzRin7zrI2pe

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2608	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2608	2656	e91296156cd506f7a152db4e4beac1c56ce03676f16db637c97cd135038409ff.exe	30
PID 2656 wrote to memory of 2608	2656	e91296156cd506f7a152db4e4beac1c56ce03676f16db637c97cd135038409ff.exe	30
PID 2656 wrote to memory of 2608	2656	e91296156cd506f7a152db4e4beac1c56ce03676f16db637c97cd135038409ff.exe	30
PID 2656 wrote to memory of 2608	2656	e91296156cd506f7a152db4e4beac1c56ce03676f16db637c97cd135038409ff.exe	30
PID 2656 wrote to memory of 2608	2656	e91296156cd506f7a152db4e4beac1c56ce03676f16db637c97cd135038409ff.exe	30
PID 2656 wrote to memory of 2608	2656	e91296156cd506f7a152db4e4beac1c56ce03676f16db637c97cd135038409ff.exe	30
PID 2656 wrote to memory of 2608	2656	e91296156cd506f7a152db4e4beac1c56ce03676f16db637c97cd135038409ff.exe	30

C:\Users\Admin\AppData\Local\Temp\e91296156cd506f7a152db4e4beac1c56ce03676f16db637c97cd135038409ff.exe
"C:\Users\Admin\AppData\Local\Temp\e91296156cd506f7a152db4e4beac1c56ce03676f16db637c97cd135038409ff.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /u /S J9SMW.NXS
  2⤵
  - Loads dropped DLL
  PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\J9SMW.NXS

Filesize
2.1MB

MD5
e53a4ae918b729caeeef26f1fb762c2c

SHA1
689e76a00d4d4957d63823b873f5277f6c8d0eb2

SHA256
0b18993e39094c2f85590ac4abcac3539bcf3f28d1e4c291567860992977459c

SHA512
919bd69b5eeb76e8a20b52d01b2df760a044610fafd336a22493cb707e28eab28308524dc9cc7e21ae5d3d0d08c68b9d13d5f5c8ad380e3648c27b3c9fd5c5c3

Download Submit
memory/2608-4-0x0000000001EE0000-0x00000000020F8000-memory.dmp

Filesize
2.1MB

Download
memory/2608-5-0x0000000001EE0000-0x00000000020F8000-memory.dmp

Filesize
2.1MB

Download
memory/2608-7-0x00000000024D0000-0x00000000025CC000-memory.dmp

Filesize
1008KB

Download
memory/2608-11-0x00000000025D0000-0x00000000026B3000-memory.dmp

Filesize
908KB

Download
memory/2608-8-0x00000000025D0000-0x00000000026B3000-memory.dmp

Filesize
908KB

Download
memory/2608-12-0x00000000025D0000-0x00000000026B3000-memory.dmp

Filesize
908KB

Download