7fb4d308f3e7ca13809cf7fda7e0a6768366d0bd7729ab3bb7fe3bf6f3fcdbae

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 00:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7fb4d308f3e7ca13809cf7fda7e0a6768366d0bd7729ab3bb7fe3bf6f3fcdbae.exe
Size

61KB
MD5

26ee93b4fb4550e83b778dcc0f150055
SHA1

e8c890a29cea076ea9979811922573e80a613391
SHA256

7fb4d308f3e7ca13809cf7fda7e0a6768366d0bd7729ab3bb7fe3bf6f3fcdbae
SHA512

53a32194b2eaa9c8963e4c45cdc80a1df6a0841a984697a45191ffa3edd51ea0d40e402f74e843fbb5c6696d0915ce6fd4144bf8de84817b9a04edaf98e4e2be
SSDEEP

768:eFq/4qn0F1raGCI3FfeMLT++G31LSadk344524444/McoUCy6ZHtd2X7Q:qk4e0VCI33T++C1uaeN6T6Jtd2M

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1732	edurss.exe

Loads dropped DLL 1 IoCs

pid	Process
1676	7fb4d308f3e7ca13809cf7fda7e0a6768366d0bd7729ab3bb7fe3bf6f3fcdbae.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 1732	1676	7fb4d308f3e7ca13809cf7fda7e0a6768366d0bd7729ab3bb7fe3bf6f3fcdbae.exe	28
PID 1676 wrote to memory of 1732	1676	7fb4d308f3e7ca13809cf7fda7e0a6768366d0bd7729ab3bb7fe3bf6f3fcdbae.exe	28
PID 1676 wrote to memory of 1732	1676	7fb4d308f3e7ca13809cf7fda7e0a6768366d0bd7729ab3bb7fe3bf6f3fcdbae.exe	28
PID 1676 wrote to memory of 1732	1676	7fb4d308f3e7ca13809cf7fda7e0a6768366d0bd7729ab3bb7fe3bf6f3fcdbae.exe	28

C:\Users\Admin\AppData\Local\Temp\7fb4d308f3e7ca13809cf7fda7e0a6768366d0bd7729ab3bb7fe3bf6f3fcdbae.exe
"C:\Users\Admin\AppData\Local\Temp\7fb4d308f3e7ca13809cf7fda7e0a6768366d0bd7729ab3bb7fe3bf6f3fcdbae.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Users\Admin\AppData\Local\Temp\edurss.exe
  "C:\Users\Admin\AppData\Local\Temp\edurss.exe"
  2⤵
  - Executes dropped EXE
  PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\edurss.exe

Filesize
61KB

MD5
9fea7977a85363ba3d4e25e9d846ac04

SHA1
04e5a94979a5001a7ff734cd3162397434088673

SHA256
c456c57f0c6db4b759b00a52ed4f435804f6cad9302a76ba9b9ba16adaa155fb

SHA512
6098dc196ec1048f9729589c8b24b41f900cf130cdada3addd905fb2da8450e6f578f0857b7b0562bc97659db516ab102ad4ab762bd4dfdc42962c1b0e5c86d9

Download Submit
memory/1676-0-0x0000000004000000-0x0000000004005000-memory.dmp

Filesize
20KB

Download
memory/1676-1-0x0000000004000000-0x0000000004005000-memory.dmp

Filesize
20KB

Download