3a3ccd72e07241dc8037fa38626058f25767f9f7a78ee68a372632841004ee79

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 03:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dbfman131.exe
Size 1.5MB
Sample240723-dqb1lavdml
SHA256 72972e69c11a806df73ff906b73dc9590efd45b2276effee4f62d3a29d8437ef
MD5 62129b51206ff5f5fec86c79e88dce7d
SHA1 b739264cdce595709348282c5f6802ce0b6b10a6
SHA512 e17b5823e4bc6b150580a6916565d5f72500f4000e42db28f0e90cd4b1047799a75a5a15949b48b254dac34f337126dbe913b795e2c13ca048c3f6dae7f33d0c
SSDEEP 49152:4nH5Y5MgqcSaV3DWxlxPEq83Oq+Qt1D8A5:IH5Y+gb1V3DaxPE/3OqniA5
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2980	dbfman131.exe
2980	dbfman131.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\dbfman131.exe
"C:\Users\Admin\AppData\Local\Temp\dbfman131.exe"
1⤵
- Loads dropped DLL
PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyB631.tmp\InstallOptions.dll
Size 12KB
SHA256 0f4d3cee24e3f310fa804983c931d3628613988a24f0be7854f63a9309b8e45f
MD5 1d5c649dde35003a618b9679d5d71b92
SHA1 0409bbab3ab34f8c01289cdd847b4d1a32d05b18
SHA512 b432ebcc52905662d61a3f17e08e209a3f9d836a9071b3b5e80070af7ebcf34cf66c44426dda041c2a258fda4787e5692e2b35acbcd73288fb84fe3c977bbfd9
SSDEEP 384:pKlm7i+c3QW6ckPhyDEaLnA2bbBBIXwZ:8qi8BcyhEhLBbbTI
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyB631.tmp\System.dll
Size 10KB
SHA256 cf61ddd15d63c25a12caee70f51ea736cfc02195c42e56ee01b33f689d3754c5
MD5 4eff5fafd746f5decb93a44e3a3d570c
SHA1 a11aa7681b7e2df1c7f7492a127d332d1495ea8a
SHA512 cde82d2a1f28506e4c2264f6b82017a00af32f138ebcdbaf4cc58463870fa626f708aa57465294c5a6f096c886841e7b9112b85bf3ea2f1d8f2da816b51b2d72
SSDEEP 192:0OycJo/rJVCmIDNLU0dq5RD00lspbub76yL:6/QQ0d0RD0USq/6y
MD5 SHA1 SHA512 SSDEEP

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsyB631.tmp\ioSpecial.ini
Size 690B
SHA256 de963635c5dc4d24893fe0bb21558b39e300346261960a857261a77b8ef974c4
MD5 4457a666a0c798492260b8375bca819b
SHA1 14b95d63a8537855c7aa821877762cd2a4d56d6e
SHA512 2c79eac7748e0d5743763fb71963c75d719999882555e5d9aa8e37ebbb50008a12e2cd310a9c22164c8f27a7306d54edf562858d2a65847cf9cc06350549c5fd
MD5 SHA1 SHA512

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsyB631.tmp\ioSpecial.ini
Size 729B
SHA256 db66bdfb468bb8361d791521d428e77da151395deab9cffe7bab96619c636f4a
MD5 09075e37619824abfd7435a2cf02142e
SHA1 e5c3918272d363c54bd365902f2e0d44879a46da
SHA512 c81690c750f667cf908a3e35841f994dc909beb897699288f4f7d6699dcb2a1492e95b4efb4d77ef70067202e3f9d7ec563d2946e3c5272c620822314806fe01
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads