f2e5a0cd3ad67ce08355c82525410f94484becd9ab5290245baad29633506b18

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 08:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

main.exe
Size

35.4MB
MD5

2171c1030c8ef81b3d358519af67de82
SHA1

3ddf1d2798d351c6176d17d618d8e4572abe05e5
SHA256

e9cc790d80084d871196a56fc53f02a82ecc58c2e1321c07fa6db01002c5c04c
SHA512

a65ff90ba63e43a5784a79e422d094082a4e78baa3e52593f624a41c3c47e6f1f03d0693c328d001bdfe5fc05b957400d5293cce88784eb91e78f032ded5bd6d
SSDEEP

786432:pccIpAjY8dwtj9AK7DIZPFwyfyV4OwtD9WFhJjPcxImWl1wf7OJXiMLV3anZ8tav:ucIpAdQ+BPFwyfyHwtDsFPBwqJXiMpmF

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3028	main.exe

Loads dropped DLL 2 IoCs

pid	Process
1548	main.exe
3028	main.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 3028	1548	main.exe	29
PID 1548 wrote to memory of 3028	1548	main.exe	29
PID 1548 wrote to memory of 3028	1548	main.exe	29

C:\Users\Admin\AppData\Local\Temp\main.exe
"C:\Users\Admin\AppData\Local\Temp\main.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Users\Admin\AppData\Local\Temp\onefile_1548_133637774415672000\main.exe
  "C:\Users\Admin\AppData\Local\Temp\main.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\onefile_1548_133637774415672000\main.exe

Filesize
43.4MB

MD5
6e9d3e1015a944dd20120d792ec80453

SHA1
9f490e82a1329d73c3117e61fee3de89004b08c7

SHA256
e8f1c1b00978443e9808e9671bbf8c8b402311cc3f1086b99d3c7970476df82d

SHA512
73b3342a6db4eb8155fa62bbf1c31a205a25bff12e9053a7c1d1a7b2feba2d3fe2db38e1245e8b6fd498ede373bb56d2456d821a0c317c4ca4b1738e6bdeae00

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1548_133637774415672000\python310.dll

Filesize
4.3MB

MD5
63a1fa9259a35eaeac04174cecb90048

SHA1
0dc0c91bcd6f69b80dcdd7e4020365dd7853885a

SHA256
14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed

SHA512
896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b

Download Submit