69deb4c238c29a0473d6aa41f3ad5f7a57a99b22d4da7c408978b1beac61eb7c

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 21:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aquatic/loader.exe
Size

5.0MB
MD5

c679369a7270cb8f284b96ba9325b007
SHA1

c33955d7a9f44ab9ef7e67031960fcbb13690714
SHA256

a0fb1568891680d66efb9f545ed1cdc9c8124d96e220cbdd8b618769be6e6083
SHA512

081152540c6579c0cd27f201f8b0a8956a1debc58c538c47dc88a99aa64929ca28f2eb9b3229d61618c6d979d583cfeca6a930d3dc56ff6f138989774372079f
SSDEEP

98304:Hc/jJ36G67LQVRzp6ELW++55YhTO1mv3JbYyIeq1SWdeHV6IKpqAMX0O54cy0:8NqoXzpbKKOQRbGv6HAHwXsf0

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2608	loader.exe

Loads dropped DLL 2 IoCs

pid	Process
1964	loader.exe
2608	loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2608	1964	loader.exe	29
PID 1964 wrote to memory of 2608	1964	loader.exe	29
PID 1964 wrote to memory of 2608	1964	loader.exe	29

C:\Users\Admin\AppData\Local\Temp\aquatic\loader.exe
"C:\Users\Admin\AppData\Local\Temp\aquatic\loader.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\onefile_1964_133639989725080000\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\aquatic\loader.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\onefile_1964_133639989725080000\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit
\Users\Admin\AppData\Local\Temp\onefile_1964_133639989725080000\loader.exe

Filesize
9.7MB

MD5
b8e9bd84e2582b428785ae52636ce590

SHA1
585d542155d9edd098d236ba89f3d8c52283fbbc

SHA256
b39610bf0233ae7c7e1a6230072a65c014ec4c56fa10be7d66ffca2105775141

SHA512
21462b75bc60481894d81516827faafbb77605018959f9c5cfd1aa68be7a480e609db8e08049ce37187547d7e5f731a9f4b9de23bfbf34e1613581129c65253e

Download Submit
memory/1964-28-0x000000013F140000-0x000000013F655000-memory.dmp

Filesize
5.1MB

Download