83c4e5947870b7b9f06044624b420ddc9fbae6898a5c9b4420c3dbeaca508bb9

Resubmissions

07-08-2024 21:04

240807-zwtcqatgpj 7

07-08-2024 21:03

240807-zv9cjsxfja 7

Analysis

max time kernel
21s
max time network
24s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
07-08-2024 21:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Incognito_public0.2.exe
Size

6.9MB
MD5

10bbd38c21ebf84fea97c3812d57d9c6
SHA1

293cec0d7f44151ffbf88dfe408265825f8bca9b
SHA256

83c4e5947870b7b9f06044624b420ddc9fbae6898a5c9b4420c3dbeaca508bb9
SHA512

a00ec8ed84b806c4aca8564354a6687da64b999d255df7fea4c38e6026c8a4cee665414e96d5e28904d051f4c1a6956193a96c12e52286d6d7f58f39bae8ac31
SSDEEP

196608:ESw7sghUuE1R1R9iVTdRUo/Rf7KG0ZLK+4eCA6Pt7R:PwDh10RsFzUURTclC5t7

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2964	test.exe

Loads dropped DLL 2 IoCs

pid	Process
1760	Incognito_public0.2.exe
2964	test.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2964	1760	Incognito_public0.2.exe	31
PID 1760 wrote to memory of 2964	1760	Incognito_public0.2.exe	31
PID 1760 wrote to memory of 2964	1760	Incognito_public0.2.exe	31

C:\Users\Admin\AppData\Local\Temp\Incognito_public0.2.exe
"C:\Users\Admin\AppData\Local\Temp\Incognito_public0.2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Users\Admin\AppData\Local\Temp\onefile_1760_133675382213540000\test.exe
  "C:\Users\Admin\AppData\Local\Temp\Incognito_public0.2.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\onefile_1760_133675382213540000\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1760_133675382213540000\test.exe

Filesize
9.6MB

MD5
5244aa93f4209963f6c63e1ef9dde0b9

SHA1
642219eec726127fe7fbe9ceb5e223dcf46fbe46

SHA256
aeca166d5d3da9e76957686ca8753e95b930d8508f825f3cc6b4bac28da6e142

SHA512
e510165f98b070ad3c202734833230779fd95585d28b0a9873afbb5022f488c85e935b7f366a92b89449b42106f4ed76997cac16994386560bd45021d368e28c

Download Submit