Analysis

  • max time kernel
    150s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250502-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/05/2025, 09:56

General

  • Target

    9bec196e2b6574b6b861b80d2c88f9df882665b4111f180c0e036f91e51ae4ce.exe

  • Size

    151KB

  • MD5

    7b78be4d71426cef503871fded2dc0d2

  • SHA1

    0352bcd5991a5bc6bc1184f938d2b736d813fbdb

  • SHA256

    9bec196e2b6574b6b861b80d2c88f9df882665b4111f180c0e036f91e51ae4ce

  • SHA512

    2e8ace21e00c7d9641275030d2d81f73abccf93158a09d0fbbbc128872948ce5bafaa23c1cf307d268ff0755746d2e06789dfcccc814a63de5311d1c40770aa3

  • SSDEEP

    3072:yWTSIoXkZA/gwjHnrhtVufJO05m4uvHwog8yT5Fou:yWTSIoXNHnr1GJOl4uvjgddFF

Score
9/10

Malware Config

Signatures

  • Renames multiple (5218) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9bec196e2b6574b6b861b80d2c88f9df882665b4111f180c0e036f91e51ae4ce.exe
    "C:\Users\Admin\AppData\Local\Temp\9bec196e2b6574b6b861b80d2c88f9df882665b4111f180c0e036f91e51ae4ce.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5292
    • C:\Windows\SysWOW64\Zombie.exe
      "C:\Windows\system32\Zombie.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      PID:4296
    • C:\Users\Admin\AppData\Local\Temp\_dotnet.exe
      "_dotnet.exe"
      2⤵
      • Executes dropped EXE
      PID:2196

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-2930597513-779029253-718817275-1000\desktop.ini.tmp

          Filesize

          18KB

          MD5

          415c1a63ba478df225a4e08f426232f6

          SHA1

          b572cb1ec3b74126e30a5a55afc26cf8e7db8e8b

          SHA256

          ee11e73e5a92b70b1ee4a9c6626b06030326ba05272218ac20b2b9590eca3adb

          SHA512

          e996d5f4ec9e36afcdd5b87c42ad8c4fe9882228a9c1f38ccd2a9762b773ef01a798ad2e9c404ca9bf6d1425b08124b0d00c7edd59ab679e878b31bfabbf7690

        • C:\Users\Admin\AppData\Local\Temp\_dotnet.exe

          Filesize

          133KB

          MD5

          bd2e0226c5d444555a233930906e5779

          SHA1

          ed7b36f8a6802008bba17b70c7c6beb873ca68b6

          SHA256

          a8cd8b9bd4e4b99c7d6e509d1b4fefae7bc15c1e42a218e09ddfd4a924b3da9f

          SHA512

          d2cdb8f7a384bdb8cfb82e67da27d05ba30206542bf54d815b71b8ba1ef43ebd8cdef3ed7a2debeccd397aeeb7196b29af966d7ea9cbb41acadaafb854e00971

        • C:\Windows\SysWOW64\Zombie.exe

          Filesize

          17KB

          MD5

          81fc313583ccf1af2e200d929f8296ac

          SHA1

          367ebe8c9279cfe7ff9bcfcfb79abe2a84ab5aac

          SHA256

          2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7

          SHA512

          628bb9220a1aececfeae1173e0efdf9e6eb21e5304f0a40492c3339c11b70c403376a368189ccf4a71ed0d3600c7ccc196531b2c2bb3cf92bd33187b35d1534c

        • memory/5292-23-0x0000000000400000-0x0000000000407000-memory.dmp

          Filesize

          28KB