396d6be9b81cce5334de2cf4e9d643efb64927af286758aa2f48b2145b24ee81

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 02:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55c4fce976296f1655cc43cac32a26a0N.exe
Size

5KB
MD5

55c4fce976296f1655cc43cac32a26a0
SHA1

e530ffffdda49d923e2397c010ece5b6e8b5a219
SHA256

396d6be9b81cce5334de2cf4e9d643efb64927af286758aa2f48b2145b24ee81
SHA512

5545d4dc2b8e62a4222752751e196483b0e6b95e0adc999a05282dab718b9acf4ebfeb94d53699cda7c5712130f92e78d857dd726e5ad34285cc90b6a2f4ae26
SSDEEP

48:qajxtxAmcRB/G99//8dIJMPC3u1rsHB/VnC/RAxU92CS70ALNxD8Q8:FnKhLPdUUiuuHnnwR2U92ClAhxDW

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3044	budha.exe

Loads dropped DLL 2 IoCs

pid	Process
1596	55c4fce976296f1655cc43cac32a26a0N.exe
1596	55c4fce976296f1655cc43cac32a26a0N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 3044	1596	55c4fce976296f1655cc43cac32a26a0N.exe	29
PID 1596 wrote to memory of 3044	1596	55c4fce976296f1655cc43cac32a26a0N.exe	29
PID 1596 wrote to memory of 3044	1596	55c4fce976296f1655cc43cac32a26a0N.exe	29
PID 1596 wrote to memory of 3044	1596	55c4fce976296f1655cc43cac32a26a0N.exe	29

C:\Users\Admin\AppData\Local\Temp\55c4fce976296f1655cc43cac32a26a0N.exe
"C:\Users\Admin\AppData\Local\Temp\55c4fce976296f1655cc43cac32a26a0N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Executes dropped EXE
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
5KB

MD5
fc4552c59140c7e1c33d4b9eee9a727b

SHA1
bb1d75da4dfc3fae17ecd72b0fa1576210a9b682

SHA256
e8da8d19b04f04468b6f64dfc9c53e988a6c912628df21171aa255fb6f62a1db

SHA512
b6bd841c436856144d45cfaac5f1ad5a563d714bee98d3f9d146f2f93ba66dfacad59781f683ddecab77317b84244caa8917c50e3e1c6a3bca2bad22b37d9f20

Download Submit