200beb929cd95dcef284c39e5690e4de1198c13d58fc9b116151d33bdc7aa16c

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 00:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

200beb929cd95dcef284c39e5690e4de1198c13d58fc9b116151d33bdc7aa16c.exe
Size

50KB
MD5

f44a0025b4f1e58b9f79d00ca9ec8bf0
SHA1

87fc848706b0fef1ecf2cca6a69167618fa60d61
SHA256

200beb929cd95dcef284c39e5690e4de1198c13d58fc9b116151d33bdc7aa16c
SHA512

3443d436d389968abddecc59b18af6db2e87d245734faa267df0c8f2a474c6447f09e2b9b7b3a526a89ece1ccdc57b7d783a6ce53b31f5dd4bc51751d98bb121
SSDEEP

768:hAvJ4LSyC8aVN7bX3V0S0AVrEXAgTlxorsf8ISy0:2B4OyC8aVN7jljBmpOrs83y0

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1900	comhost.exe

Loads dropped DLL 2 IoCs

pid	Process
1752	200beb929cd95dcef284c39e5690e4de1198c13d58fc9b116151d33bdc7aa16c.exe
1752	200beb929cd95dcef284c39e5690e4de1198c13d58fc9b116151d33bdc7aa16c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1900	1752	200beb929cd95dcef284c39e5690e4de1198c13d58fc9b116151d33bdc7aa16c.exe	28
PID 1752 wrote to memory of 1900	1752	200beb929cd95dcef284c39e5690e4de1198c13d58fc9b116151d33bdc7aa16c.exe	28
PID 1752 wrote to memory of 1900	1752	200beb929cd95dcef284c39e5690e4de1198c13d58fc9b116151d33bdc7aa16c.exe	28
PID 1752 wrote to memory of 1900	1752	200beb929cd95dcef284c39e5690e4de1198c13d58fc9b116151d33bdc7aa16c.exe	28

C:\Users\Admin\AppData\Local\Temp\200beb929cd95dcef284c39e5690e4de1198c13d58fc9b116151d33bdc7aa16c.exe
"C:\Users\Admin\AppData\Local\Temp\200beb929cd95dcef284c39e5690e4de1198c13d58fc9b116151d33bdc7aa16c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Users\Admin\AppData\Local\Temp\comhost.exe
  "C:\Users\Admin\AppData\Local\Temp\comhost.exe"
  2⤵
  - Executes dropped EXE
  PID:1900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\comhost.exe

Filesize
50KB

MD5
6f39630a209a1520cc76e45d4afb3d40

SHA1
7223e445f05e89481e9d9fb0bc102b327a464d61

SHA256
ba8da7c644dbf2fca941365189d3f7e10abaaf9c1a7be71330f508e1b8aa93df

SHA512
fada9759f934dcca383be0e4895c189c1dc22b4caa0025d1bb05578b7a93c5d334ab138126cffc398140ed2f9c1455575efa28e15f279a7dbe122ee8db87d820

Download Submit
memory/1752-1-0x0000000000402000-0x0000000000403000-memory.dmp

Filesize
4KB

Download
memory/1900-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download