e289a8dcdbf730adc13799ecf0bc2217a43a80a660989bf160c2c9d38dec23f2 | Triage

Analysis

max time kernel
10s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
15/09/2024, 16:03

Sharing

Report Analysis Logs

General

Target

Cwelium.exe
Size

12.8MB
MD5

7bbcd32674a9fdaaf5b5e5f066fcdab4
SHA1

3b10c3da29332c19495233003348a8c9838d5c1f
SHA256

e289a8dcdbf730adc13799ecf0bc2217a43a80a660989bf160c2c9d38dec23f2
SHA512

ee5b1ab82f74b5b0a31cc683b97b4adcf82483db8aa04cae3fdb6563287492ab71f7992e167f38c28efd664a810628ff645c0a174b3a4ba574e6b7f3764ebc92
SSDEEP

196608:rieBmOnMWLeYDr61E1H40rg9T+IRaM7fYPKUddpc1+i/jcnsr+iQ9zz92LURXt:rie0OnMzV1A40rMaPM08pgnVLzoLUp

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\Cwelium.exe
"C:\Users\Admin\AppData\Local\Temp\Cwelium.exe"
1⤵
PID:3616

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3616-39-0x00007FF7218A0000-0x00007FF722593000-memory.dmp

Filesize
12.9MB

Download