a1ddae9574bbeadd40b789fc8c7719b47c0d4bd8ed93abbd1d07f7e866ac40a6

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98cae67f5c84a8d9acc00a5117a1554f.exe
Size

2.1MB
MD5

98cae67f5c84a8d9acc00a5117a1554f
SHA1

21527275a801dcac3efb0491f11e3d2904293fb0
SHA256

fffd5222db48561afd0141bc1c15b66f10bec748d7430a6a4a79dc3899485f2f
SHA512

6044797b07bff8f9a78fc84f3279db7ff98517e03f26305dd58d62122ce199280c81a64aef68e7def789b4d7bd7fd1b6a8ab1c404f3f47ab97bcda1247b8d99a
SSDEEP

49152:X/FBVWix5TC0/5ljAhscAWlMym/HXR1supwJ4CfI:J

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1764	au2lfsnm.yqa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 1764	2392	98cae67f5c84a8d9acc00a5117a1554f.exe	30
PID 2392 wrote to memory of 1764	2392	98cae67f5c84a8d9acc00a5117a1554f.exe	30
PID 2392 wrote to memory of 1764	2392	98cae67f5c84a8d9acc00a5117a1554f.exe	30

C:\Users\Admin\AppData\Local\Temp\98cae67f5c84a8d9acc00a5117a1554f.exe
"C:\Users\Admin\AppData\Local\Temp\98cae67f5c84a8d9acc00a5117a1554f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Users\Admin\AppData\Local\Temp\au2lfsnm.yqa.exe
  "C:\Users\Admin\AppData\Local\Temp\au2lfsnm.yqa.exe"
  2⤵
  - Executes dropped EXE
  PID:1764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\au2lfsnm.yqa.exe

Filesize
777KB

MD5
67c847973f3c013e3e5049f6a82ae1b5

SHA1
ddd92d14cc4c4e1e5a3afcb24087f997e63f561f

SHA256
0efeb9b6ed577e71905b9944d794da8ee14084c6cde61d5bb695c10448c75933

SHA512
eff87736136998b54fdd952b4e85fa800d13bad9ffa9863dd55595f3e7ca2c557cf0ba45ab47fb06f79ba6efd07294f8f1fab30cd81c5b9bcc5e02f25419c86e

Download Submit
memory/1764-8-0x0000000000AA0000-0x0000000000B66000-memory.dmp

Filesize
792KB

Download
memory/1764-10-0x000007FEF6260000-0x000007FEF6C4C000-memory.dmp

Filesize
9.9MB

Download
memory/1764-11-0x000007FEF6260000-0x000007FEF6C4C000-memory.dmp

Filesize
9.9MB

Download
memory/2392-0-0x000007FEF6263000-0x000007FEF6264000-memory.dmp

Filesize
4KB

Download
memory/2392-1-0x0000000000340000-0x000000000055C000-memory.dmp

Filesize
2.1MB

Download
memory/2392-9-0x00000000007F0000-0x0000000000800000-memory.dmp

Filesize
64KB

Download