Analysis
-
max time kernel
89s -
max time network
99s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
07/06/2024, 16:10
Behavioral task
behavioral1
Sample
b44be4fc0b9817fd5294895d217f691e1bba2e781a9286831d2f4a98fb63b47b.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
b44be4fc0b9817fd5294895d217f691e1bba2e781a9286831d2f4a98fb63b47b.exe
Resource
win11-20240508-en
General
-
Target
b44be4fc0b9817fd5294895d217f691e1bba2e781a9286831d2f4a98fb63b47b.exe
-
Size
266KB
-
MD5
01c5d982e9a94b2088446e1298dfd956
-
SHA1
cc9600b95ee385c0b78330d19d0e9d3f49c7e95d
-
SHA256
b44be4fc0b9817fd5294895d217f691e1bba2e781a9286831d2f4a98fb63b47b
-
SHA512
f07d48b02299a7f9dff18f1fd4921ea8a02de2792e32ec9988bf17321f4eceafded9ca53a069d140fd5e3d482e50b3dc330c20d065e2cd7c9293e48ecf9a71af
-
SSDEEP
3072:jNXEGZJWhfNFC4S60+XoLczrVmX+DdpF8MZiHlJkbZ+Y+x+tfnEafTaRH01ne4PK:JXzKdNY49u8rV1/kkKInEaf2Z01net
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 956 ITS SB App Switch.exe 2400 ITS SB App Switch.exe -
resource yara_rule behavioral2/memory/1516-0-0x0000000000610000-0x00000000006B0000-memory.dmp upx behavioral2/memory/1516-14-0x0000000000610000-0x00000000006B0000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1516 b44be4fc0b9817fd5294895d217f691e1bba2e781a9286831d2f4a98fb63b47b.exe 1516 b44be4fc0b9817fd5294895d217f691e1bba2e781a9286831d2f4a98fb63b47b.exe 1516 b44be4fc0b9817fd5294895d217f691e1bba2e781a9286831d2f4a98fb63b47b.exe 1516 b44be4fc0b9817fd5294895d217f691e1bba2e781a9286831d2f4a98fb63b47b.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1516 wrote to memory of 956 1516 b44be4fc0b9817fd5294895d217f691e1bba2e781a9286831d2f4a98fb63b47b.exe 77 PID 1516 wrote to memory of 956 1516 b44be4fc0b9817fd5294895d217f691e1bba2e781a9286831d2f4a98fb63b47b.exe 77 PID 1516 wrote to memory of 956 1516 b44be4fc0b9817fd5294895d217f691e1bba2e781a9286831d2f4a98fb63b47b.exe 77 PID 1516 wrote to memory of 2400 1516 b44be4fc0b9817fd5294895d217f691e1bba2e781a9286831d2f4a98fb63b47b.exe 78 PID 1516 wrote to memory of 2400 1516 b44be4fc0b9817fd5294895d217f691e1bba2e781a9286831d2f4a98fb63b47b.exe 78 PID 1516 wrote to memory of 2400 1516 b44be4fc0b9817fd5294895d217f691e1bba2e781a9286831d2f4a98fb63b47b.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\b44be4fc0b9817fd5294895d217f691e1bba2e781a9286831d2f4a98fb63b47b.exe"C:\Users\Admin\AppData\Local\Temp\b44be4fc0b9817fd5294895d217f691e1bba2e781a9286831d2f4a98fb63b47b.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe"C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe"2⤵
- Executes dropped EXE
PID:956
-
-
C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe"C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe"2⤵
- Executes dropped EXE
PID:2400
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87KB
MD5368332fca74f48697d842c5f4698ae1d
SHA10275153a1e62bd0eca0b02168895517ed66aac56
SHA2563a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59
SHA512fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5