Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    12/06/2024, 04:33

General

  • Target
    b6138bd31f0930d6f489ac8ef0dad8333b30bcebc51c0940b19ab4cb3ffbab73.exe
  • Size 7.1MB
  • Sample240612-e6wkls1cnp
  • SHA256 b6138bd31f0930d6f489ac8ef0dad8333b30bcebc51c0940b19ab4cb3ffbab73
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b6138bd31f0930d6f489ac8ef0dad8333b30bcebc51c0940b19ab4cb3ffbab73.exe
    "C:\Users\Admin\AppData\Local\Temp\b6138bd31f0930d6f489ac8ef0dad8333b30bcebc51c0940b19ab4cb3ffbab73.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    PID:1712

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        LogEx.dll

        • Path \Users\Admin\AppData\Local\Temp\nsi284A.tmp\LogEx.dll
        • Size 44KB
        • SHA256 57ede354532937e38c4ae9da3710ee295705ea9770c402dfb3a5c56a32fd4314
        • MD5 SHA1 SHA512 SSDEEP

        System.dll

        • Path \Users\Admin\AppData\Local\Temp\nsi284A.tmp\System.dll
        • Size 12KB
        • SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
        • MD5 SHA1 SHA512 SSDEEP

        nsDialogs.dll

        • Path \Users\Admin\AppData\Local\Temp\nsi284A.tmp\nsDialogs.dll
        • Size 9KB
        • SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
        • MD5 SHA1 SHA512 SSDEEP

        nsProcess.dll

        • Path \Users\Admin\AppData\Local\Temp\nsi284A.tmp\nsProcess.dll
        • Size 4KB
        • SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
        • MD5 SHA1 SHA512 SSDEEP