3a3ccd72e07241dc8037fa38626058f25767f9f7a78ee68a372632841004ee79

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 03:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dbfman131.exe
Size

1.5MB
MD5

62129b51206ff5f5fec86c79e88dce7d
SHA1

b739264cdce595709348282c5f6802ce0b6b10a6
SHA256

72972e69c11a806df73ff906b73dc9590efd45b2276effee4f62d3a29d8437ef
SHA512

e17b5823e4bc6b150580a6916565d5f72500f4000e42db28f0e90cd4b1047799a75a5a15949b48b254dac34f337126dbe913b795e2c13ca048c3f6dae7f33d0c
SSDEEP

49152:4nH5Y5MgqcSaV3DWxlxPEq83Oq+Qt1D8A5:IH5Y+gb1V3DaxPE/3OqniA5

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2876	dbfman131.exe
2876	dbfman131.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2876	dbfman131.exe

C:\Users\Admin\AppData\Local\Temp\dbfman131.exe
"C:\Users\Admin\AppData\Local\Temp\dbfman131.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsy6549.tmp\ioSpecial.ini

Filesize
690B

MD5
9d97292f6be4115664f27f9aa2a79b07

SHA1
9d22da0ad6177e9a68004a04ff9f080bdefee80d

SHA256
21b08a469e3f7a5763c4b0f43076c87c41a6f090912e7719032734eb336530e3

SHA512
e8502ea844477f995a3e16f926244dccef1ad68d4d972da33ce57a2ff5ed9598e4e626bde5fb8f2c8680e40a3750e08c226104cf79a72f0f3616406a4a67ad56

Download Submit
\Users\Admin\AppData\Local\Temp\nsy6549.tmp\InstallOptions.dll

Filesize
12KB

MD5
1d5c649dde35003a618b9679d5d71b92

SHA1
0409bbab3ab34f8c01289cdd847b4d1a32d05b18

SHA256
0f4d3cee24e3f310fa804983c931d3628613988a24f0be7854f63a9309b8e45f

SHA512
b432ebcc52905662d61a3f17e08e209a3f9d836a9071b3b5e80070af7ebcf34cf66c44426dda041c2a258fda4787e5692e2b35acbcd73288fb84fe3c977bbfd9

Download Submit
\Users\Admin\AppData\Local\Temp\nsy6549.tmp\System.dll

Filesize
10KB

MD5
4eff5fafd746f5decb93a44e3a3d570c

SHA1
a11aa7681b7e2df1c7f7492a127d332d1495ea8a

SHA256
cf61ddd15d63c25a12caee70f51ea736cfc02195c42e56ee01b33f689d3754c5

SHA512
cde82d2a1f28506e4c2264f6b82017a00af32f138ebcdbaf4cc58463870fa626f708aa57465294c5a6f096c886841e7b9112b85bf3ea2f1d8f2da816b51b2d72

Download Submit