c8c9aca6b4b12ce0df5b2c43171828b354a20310973f0112dc19567fb787c6d4

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 02:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8c9aca6b4b12ce0df5b2c43171828b354a20310973f0112dc19567fb787c6d4.exe
Size

56KB
MD5

066b327b839fff241826b3b66248ca99
SHA1

ba8e94cda3226a12a1213ce049c28bf320933c24
SHA256

c8c9aca6b4b12ce0df5b2c43171828b354a20310973f0112dc19567fb787c6d4
SHA512

9c04422872588426d2619b22692d89bb3ba2d44fe8725e817c92e89992ef85ae80dd7a615700cdc21fbec757e1bfad1471c2139cfeb5d808b805f4f059c4a27c
SSDEEP

768:jxDDnyAiIbhn+oRTaFSxjquEDFAnA1tLRNk2djaYoCMHosOxECOsPNu:jxDDnd1Raqq2uBNdSCMxCV1u

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2320	hcbnaf.exe

Loads dropped DLL 1 IoCs

pid	Process
1924	c8c9aca6b4b12ce0df5b2c43171828b354a20310973f0112dc19567fb787c6d4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2320	1924	c8c9aca6b4b12ce0df5b2c43171828b354a20310973f0112dc19567fb787c6d4.exe	28
PID 1924 wrote to memory of 2320	1924	c8c9aca6b4b12ce0df5b2c43171828b354a20310973f0112dc19567fb787c6d4.exe	28
PID 1924 wrote to memory of 2320	1924	c8c9aca6b4b12ce0df5b2c43171828b354a20310973f0112dc19567fb787c6d4.exe	28
PID 1924 wrote to memory of 2320	1924	c8c9aca6b4b12ce0df5b2c43171828b354a20310973f0112dc19567fb787c6d4.exe	28

C:\Users\Admin\AppData\Local\Temp\c8c9aca6b4b12ce0df5b2c43171828b354a20310973f0112dc19567fb787c6d4.exe
"C:\Users\Admin\AppData\Local\Temp\c8c9aca6b4b12ce0df5b2c43171828b354a20310973f0112dc19567fb787c6d4.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Users\Admin\AppData\Local\Temp\hcbnaf.exe
  "C:\Users\Admin\AppData\Local\Temp\hcbnaf.exe"
  2⤵
  - Executes dropped EXE
  PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hcbnaf.exe

Filesize
56KB

MD5
03ddd2453f95345ad73a36bb7b232e00

SHA1
6a54b8f7de07f8bb072ceee621e7259096295de7

SHA256
746a2766ba24c8f6e451cc88721c1741cc7fb7cdb5a912ed9610da03e7bb2986

SHA512
3acda57350f292394c0883061aff7d8c960cf54620bd78f359d30a96555895651b027882b12692e45939f0aa0215e70e20a89f749f7aebb510ecd163046fe15c

Download Submit
memory/1924-1-0x0000000000260000-0x0000000000264000-memory.dmp

Filesize
16KB

Download
memory/2320-8-0x00000000000B0000-0x00000000000B4000-memory.dmp

Filesize
16KB

Download