6978264eeb68cdfbdd3938678f3666d28f716345d8f611eb10b9d1082facb456

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 23:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6978264eeb68cdfbdd3938678f3666d28f716345d8f611eb10b9d1082facb456.exe
Size 31KB
Sample240602-23da7aad4v
SHA256 6978264eeb68cdfbdd3938678f3666d28f716345d8f611eb10b9d1082facb456
MD5 9c43a42cc73f8a4df7da48711b6d5f2b
SHA1 b324956cf622b539f4dc56ed5b6ea739d618b35f
SHA512 3bc028c324dee29d9d5beba9846bddee6a594f427ee0a28f42238c40f3b2ae06b923bb9255af03de4668d86d7e0b3dfa9214df5393e002bbeb02c4167e6ea4bc
SSDEEP 384:MApc8m4e0GvQak4JI341C0abnk6hJPtWf:MApQr0GvdFJI34qTk6hJPwf
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2100	sal.exe

Loads dropped DLL 2 IoCs

pid	Process
2196	6978264eeb68cdfbdd3938678f3666d28f716345d8f611eb10b9d1082facb456.exe
2196	6978264eeb68cdfbdd3938678f3666d28f716345d8f611eb10b9d1082facb456.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\sal.exe	6978264eeb68cdfbdd3938678f3666d28f716345d8f611eb10b9d1082facb456.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2100	2196	6978264eeb68cdfbdd3938678f3666d28f716345d8f611eb10b9d1082facb456.exe	28
PID 2196 wrote to memory of 2100	2196	6978264eeb68cdfbdd3938678f3666d28f716345d8f611eb10b9d1082facb456.exe	28
PID 2196 wrote to memory of 2100	2196	6978264eeb68cdfbdd3938678f3666d28f716345d8f611eb10b9d1082facb456.exe	28
PID 2196 wrote to memory of 2100	2196	6978264eeb68cdfbdd3938678f3666d28f716345d8f611eb10b9d1082facb456.exe	28

C:\Users\Admin\AppData\Local\Temp\6978264eeb68cdfbdd3938678f3666d28f716345d8f611eb10b9d1082facb456.exe
"C:\Users\Admin\AppData\Local\Temp\6978264eeb68cdfbdd3938678f3666d28f716345d8f611eb10b9d1082facb456.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2196
- C:\windows\SysWOW64\sal.exe
  "C:\windows\system32\sal.exe"
  2⤵
  - Executes dropped EXE
  PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sal.exe

Path \Windows\SysWOW64\sal.exe
Size 32KB
SHA256 0874701e7e65ddef5f51f6d8c61a32aa4ab0770d52bcc00b53f5bd0f9f450839
MD5 a57a9e0016dcd908569c279e27ee5e27
SHA1 65abff9e68d9240f0e4f987d482c310c0716c8a0
SHA512 0bdd4efe4db94cc28c450e983ae6ad9070d913a1821dfd97596cd6746b4fd80de55401b5b82eebc085a003f93e86aa1e5c154cc1bcb23869133f9c7b857c142f
SSDEEP 384:MApc8m4e0GvQak4JI341C0abnk6hJPtWRi:MApQr0GvdFJI34qTk6hJPwRi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2100-13-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/2196-0-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/2196-4-0x0000000000380000-0x0000000000389000-memory.dmp

Download

memory/2196-11-0x0000000000400000-0x0000000000409000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads