3a3ccd72e07241dc8037fa38626058f25767f9f7a78ee68a372632841004ee79

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 03:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dbfman131.exe
Size

1.5MB
MD5

62129b51206ff5f5fec86c79e88dce7d
SHA1

b739264cdce595709348282c5f6802ce0b6b10a6
SHA256

72972e69c11a806df73ff906b73dc9590efd45b2276effee4f62d3a29d8437ef
SHA512

e17b5823e4bc6b150580a6916565d5f72500f4000e42db28f0e90cd4b1047799a75a5a15949b48b254dac34f337126dbe913b795e2c13ca048c3f6dae7f33d0c
SSDEEP

49152:4nH5Y5MgqcSaV3DWxlxPEq83Oq+Qt1D8A5:IH5Y+gb1V3DaxPE/3OqniA5

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2980	dbfman131.exe
2980	dbfman131.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\dbfman131.exe
"C:\Users\Admin\AppData\Local\Temp\dbfman131.exe"
1⤵
- Loads dropped DLL
PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsyB631.tmp\InstallOptions.dll

Filesize
12KB

MD5
1d5c649dde35003a618b9679d5d71b92

SHA1
0409bbab3ab34f8c01289cdd847b4d1a32d05b18

SHA256
0f4d3cee24e3f310fa804983c931d3628613988a24f0be7854f63a9309b8e45f

SHA512
b432ebcc52905662d61a3f17e08e209a3f9d836a9071b3b5e80070af7ebcf34cf66c44426dda041c2a258fda4787e5692e2b35acbcd73288fb84fe3c977bbfd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyB631.tmp\System.dll

Filesize
10KB

MD5
4eff5fafd746f5decb93a44e3a3d570c

SHA1
a11aa7681b7e2df1c7f7492a127d332d1495ea8a

SHA256
cf61ddd15d63c25a12caee70f51ea736cfc02195c42e56ee01b33f689d3754c5

SHA512
cde82d2a1f28506e4c2264f6b82017a00af32f138ebcdbaf4cc58463870fa626f708aa57465294c5a6f096c886841e7b9112b85bf3ea2f1d8f2da816b51b2d72

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyB631.tmp\ioSpecial.ini

Filesize
690B

MD5
4457a666a0c798492260b8375bca819b

SHA1
14b95d63a8537855c7aa821877762cd2a4d56d6e

SHA256
de963635c5dc4d24893fe0bb21558b39e300346261960a857261a77b8ef974c4

SHA512
2c79eac7748e0d5743763fb71963c75d719999882555e5d9aa8e37ebbb50008a12e2cd310a9c22164c8f27a7306d54edf562858d2a65847cf9cc06350549c5fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyB631.tmp\ioSpecial.ini

Filesize
729B

MD5
09075e37619824abfd7435a2cf02142e

SHA1
e5c3918272d363c54bd365902f2e0d44879a46da

SHA256
db66bdfb468bb8361d791521d428e77da151395deab9cffe7bab96619c636f4a

SHA512
c81690c750f667cf908a3e35841f994dc909beb897699288f4f7d6699dcb2a1492e95b4efb4d77ef70067202e3f9d7ec563d2946e3c5272c620822314806fe01

Download Submit