62e6426e58924dc43252062729e4327148b183c423d7d5bc15677088bfdb5ad3

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 22:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62e6426e58924dc43252062729e4327148b183c423d7d5bc15677088bfdb5ad3.exe
Size

24KB
MD5

c8128e49c80d2a93a1b2326067b5f6c2
SHA1

0a5865a6a9c6939ab5688ba7907afcf65cf535d0
SHA256

62e6426e58924dc43252062729e4327148b183c423d7d5bc15677088bfdb5ad3
SHA512

cde6838b7366e1789e6315375de7eb586ac8271bd247e93c8d42870cfa1f7093ecaa24d2b6beb54a30bf8746d56254da1f3b552f0fa3ab5afd4073e8822305a0
SSDEEP

384:XzIT+XFpOQGR9zos2clAKLHRN74u56/R9zZwu9Ka:XMT6XOQ69zbjlAAX5e9zf

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1976	kgfdfjdk.exe

Loads dropped DLL 2 IoCs

pid	Process
1572	62e6426e58924dc43252062729e4327148b183c423d7d5bc15677088bfdb5ad3.exe
1572	62e6426e58924dc43252062729e4327148b183c423d7d5bc15677088bfdb5ad3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 1976	1572	62e6426e58924dc43252062729e4327148b183c423d7d5bc15677088bfdb5ad3.exe	28
PID 1572 wrote to memory of 1976	1572	62e6426e58924dc43252062729e4327148b183c423d7d5bc15677088bfdb5ad3.exe	28
PID 1572 wrote to memory of 1976	1572	62e6426e58924dc43252062729e4327148b183c423d7d5bc15677088bfdb5ad3.exe	28
PID 1572 wrote to memory of 1976	1572	62e6426e58924dc43252062729e4327148b183c423d7d5bc15677088bfdb5ad3.exe	28

C:\Users\Admin\AppData\Local\Temp\62e6426e58924dc43252062729e4327148b183c423d7d5bc15677088bfdb5ad3.exe
"C:\Users\Admin\AppData\Local\Temp\62e6426e58924dc43252062729e4327148b183c423d7d5bc15677088bfdb5ad3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Users\Admin\AppData\Local\Temp\kgfdfjdk.exe
  "C:\Users\Admin\AppData\Local\Temp\kgfdfjdk.exe"
  2⤵
  - Executes dropped EXE
  PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\kgfdfjdk.exe

Filesize
24KB

MD5
919b6d555fece69b07497526a5ded48c

SHA1
a4f35c3dc3894c9a064e44957cc09512a47205dd

SHA256
edb35c5da74267cc19fc2055f4e88bdbff96c002bcf59ee72e06b7a15490e407

SHA512
6aca1b3fd832e9e510fecac65fed5f98cecbfaf19e40eb0e1bd67984cda98e2d23ef03183e7abe55603c3695812fcb3bd07b158d59fd428c133f54c927b3c56e

Download Submit