Overview
overview
10Static
static
10017b236bf3...d6.exe
windows7-x64
1005676f2007...fb.exe
windows7-x64
30a025116a8...57.exe
windows7-x64
81.exe
windows7-x64
818674bbd9a...38.exe
windows7-x64
8234901adb1...b2.exe
windows7-x64
102ae06537d1...b6.exe
windows7-x64
82c02c65090...91.exe
windows7-x64
73.exe
windows7-x64
10329b3ddbf1...f9.exe
windows7-x64
10336fe6e8bc...de.exe
windows7-x64
84bd31921c8...be.exe
windows7-x64
84e180437ef...a9.exe
windows7-x64
3539b0b5d54...05.exe
windows7-x64
1053bf3a0bff...35.exe
windows7-x64
85d63c27043...42.exe
windows7-x64
85d6e1eeab9...84.exe
windows7-x64
863136e1d44...b5.exe
windows7-x64
8658110c095...6f.exe
windows7-x64
874cafa4165...c5.exe
windows7-x64
888bf025119...30.exe
windows7-x64
59fbf62bd6a...a0.exe
windows7-x64
9a89591555b...df.exe
windows7-x64
10add230a2e7...10.exe
windows7-x64
10c83bf900eb...31.exe
windows7-x64
10ccbf53569b...71.exe
windows7-x64
8db725306e6...8b.exe
windows7-x64
10e035a1741d...5f.exe
windows7-x64
7e2f4dfe61d...f8.exe
windows7-x64
8f10e957b92...41.exe
windows7-x64
8Analysis
-
max time kernel
359s -
max time network
360s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-11-2024 13:08
Behavioral task
behavioral1
Sample
017b236bf38a1cf9a52fc0bdee2d5f23f038b00f9811c8a58b8b66b1c756b8d6.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
05676f20078a7802bf07f231105f60bcfc96a20830fb79db26afa570332f97fb.exe
Resource
win7-20240903-en
Behavioral task
behavioral3
Sample
0a025116a860d7568fbda8ed84925cac06b13d6441eddf7428ac79359cd09b57.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
1.exe
Resource
win7-20240729-en
Behavioral task
behavioral5
Sample
18674bbd9af6e4e7396363a4f7d72312a50514f72ee4c4ceb131738801100438.exe
Resource
win7-20241023-en
Behavioral task
behavioral6
Sample
234901adb1100979c1e842133901f0bb8617683efeed4e3d56245f71f71aa6b2.exe
Resource
win7-20240903-en
Behavioral task
behavioral7
Sample
2ae06537d1e90d4ac1d2bca7c6309c9d1958f3e1ae9d7625bd914b10609d41b6.exe
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
2c02c650903a9cc289c62b83a56de001871b58531c4da3fc838a32b3b9e84291.exe
Resource
win7-20240903-en
Behavioral task
behavioral9
Sample
3.exe
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
329b3ddbf1c00b7767f0ec39b90eb9f4f8bd98ace60e2f6b6fbfb9adf25e3ef9.exe
Resource
win7-20240903-en
Behavioral task
behavioral11
Sample
336fe6e8bcdbe46641a6124436547df8e1090d978e3777d220bfa7553c9903de.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
4bd31921c87104105a1f11a3cbe3a93bf74593220f70bf70f678d2d468c991be.exe
Resource
win7-20240903-en
Behavioral task
behavioral13
Sample
4e180437ef807b6ded234ad54f506d0cff518c980a055013871529b5905a46a9.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
539b0b5d54757e8a2b754ecdc2939eb7cf9db0ed1728e0eca407500222668505.exe
Resource
win7-20240903-en
Behavioral task
behavioral15
Sample
53bf3a0bfff30e863442524c66ee7ca463b473a9fef5f472b71aa7d5f8216d35.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
5d63c27043f11cd292e997fdee614389929b9af339ea45ca15159478307ce642.exe
Resource
win7-20241010-en
Behavioral task
behavioral17
Sample
5d6e1eeab943b8b0bdb575aa61ac5353a841c402b36d9b455bb7f0cce5207b84.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
63136e1d447b73dcb7405b6c7cbfcda31c705cfccaeef0e5df98c623520abfb5.exe
Resource
win7-20241010-en
Behavioral task
behavioral19
Sample
658110c0956289e2b829f018e2322196327e3ab022406c77b4218f963f56ba6f.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
74cafa416573d3b31e6b4f01e70da21aa8c11f744f784278960b728b9c6208c5.exe
Resource
win7-20240903-en
Behavioral task
behavioral21
Sample
88bf025119fde24e63bbc878cd06f5e8631a6c5fd6b066adc6d9c28c6ca3a230.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
9fbf62bd6afa7c3269c549b3deae512634f02151f1bed92ff70038b4bf0cf2a0.exe
Resource
win7-20240729-en
Behavioral task
behavioral23
Sample
a89591555b9acb65353c2b854e582bc41db2fbc0eda2210b89a877d1862084df.exe
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
add230a2e7aabf2ea909f641894d9febc6673cf23623a00ce3f47bc73ec9b310.exe
Resource
win7-20240903-en
Behavioral task
behavioral25
Sample
c83bf900eb759e5de5c8b0697a101ce81573874a440ac07ae4ecbc56c4f69331.exe
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
ccbf53569be6ca3b092de09ee3ee854c6481e5df8925d57ee4b4d9f0631fe371.exe
Resource
win7-20240903-en
Behavioral task
behavioral27
Sample
db725306e6d15f5f339c2b5dc9c2daf7e11957e93e8cc9c71319c0a432e6358b.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
e035a1741d10a75402359dec278717e4e32b9d2a9ec1e1834710a2b67aa21f5f.exe
Resource
win7-20240729-en
Behavioral task
behavioral29
Sample
e2f4dfe61de56a38c2218b601ee3f3e49b8dbe8ece3e9d98cdf8358b41da5ff8.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
f10e957b92fbb2bb57e0a51eeda99dedb1b0720a1be0422b53404d3252bef741.exe
Resource
win7-20240903-en
General
-
Target
4e180437ef807b6ded234ad54f506d0cff518c980a055013871529b5905a46a9.exe
-
Size
71KB
-
MD5
7d09bbc0aee91d29b3e62aa7889d75ac
-
SHA1
dcc48feec76915615fca1db6e2e726543fba9566
-
SHA256
4e180437ef807b6ded234ad54f506d0cff518c980a055013871529b5905a46a9
-
SHA512
3f476f40f9a17919946df05bca46d0169531fd32982cc7c62ec685aef680c2fe064361da928fb174274c88f25b64db75f9c996e271e5b3a0836aa4101649a275
-
SSDEEP
192:YKA9x8uHsLXl0Hjo7WLom8YHwOrDU0U4cbHaF55n3nN7a:YKA9WuwXl0YZm8eDr40/cuF73Za
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2284 wrote to memory of 2608 2284 4e180437ef807b6ded234ad54f506d0cff518c980a055013871529b5905a46a9.exe 28 PID 2284 wrote to memory of 2608 2284 4e180437ef807b6ded234ad54f506d0cff518c980a055013871529b5905a46a9.exe 28 PID 2284 wrote to memory of 2608 2284 4e180437ef807b6ded234ad54f506d0cff518c980a055013871529b5905a46a9.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e180437ef807b6ded234ad54f506d0cff518c980a055013871529b5905a46a9.exe"C:\Users\Admin\AppData\Local\Temp\4e180437ef807b6ded234ad54f506d0cff518c980a055013871529b5905a46a9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 11442⤵PID:2608
-