Overview

overview

7

Static

static

3

SESM200425...76.exe

windows7-x64

7

SESM200425...76.exe

windows10-2004-x64

7

$PLUGINSDI...ge.dll

windows7-x64

3

$PLUGINSDI...ge.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows7-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/08/2024, 10:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    SESM20042580 UKWT5376.exe

  • Size

    1.5MB

  • MD5

    a2337a4e339c515e1a876b6299ff3e25

  • SHA1

    8f813df1a74cf1701e1c94e7ee8c1a3300622dcf

  • SHA256

    a6a009c10125451a3c7eb2a8318fb6a9ea469f1d88ba8d4156f90f4d250fa06c

  • SHA512

    a5307bb69d3587026a255bf999db62ef41160909e7d69d026a30ad7f071bd9f0877ce7d336b100e3e151292bbbf6807d2e7bb21b56e0541d4a4efd0958d8c84a

  • SSDEEP

    49152:qMwVgK80g/UzkthRz33OO/xPO+EuseS7w:f+VTg/UmhleSxLsN7

Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\SESM20042580 UKWT5376.exe
    "C:\Users\Admin\AppData\Local\Temp\SESM20042580 UKWT5376.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:4380

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\nsg96F1.tmp\BgImage.dll
          Filesize

          7KB

          MD5

          e2834a37c23a5c487b6e3a55eb95dd8a

          SHA1

          2ebc683fe079a8b0081283fd4adfff82f52dfa4d

          SHA256

          73abbc57661987e7a0aa7e43f6d7dcff63a74615d3b731d94891b05e0e19adcb

          SHA512

          c78edd37a46db20f56bffcc63358bde32b61552bc2e1e0960a41d36a84795e6d7fa4bb523ca1f1995ea62c60c8060cbadd5764d3a133de4ccac7501e68075e68

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\nsg96F1.tmp\UserInfo.dll
          Filesize

          4KB

          MD5

          98ff85b635d9114a9f6a0cd7b9b649d0

          SHA1

          7a51b13aa86a445a2161fa1a567cdaecaa5c97c4

          SHA256

          933f93a30ce44df96cbc4ac0b56a8b02ee01da27e4ea665d1d846357a8fca8de

          SHA512

          562342532c437236d56054278d27195e5f8c7e59911fc006964149fc0420b1f9963d72a71ebf1cd3dfee42d991a4049a382f7e669863504c16f0fe7097a07a0a

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\nsg96F1.tmp\nsDialogs.dll
          Filesize

          9KB

          MD5

          48f3e7860e1de2b4e63ec744a5e9582a

          SHA1

          420c64d802a637c75a53efc8f748e1aede3d6dc6

          SHA256

          6bf9cccd8a600f4d442efe201e8c07b49605ba35f49a4b3ab22fa2641748e156

          SHA512

          28716ddea580eeb23d93d1ff6ea0cf79a725e13c8f8a17ec9dfacb1fe29c7981ad84c03aed05663adc52365d63d19ec2f366762d1c685e3a9d93037570c3c583

          Download Submit