2205e931fcca292889c4845eb2b0e961fc7b598c276b6abf71bb5cf6c59c1132

Target

8 (11).exe
Size

3.0MB
MD5

bb072cad921aa5ce8b97706ce01bc570
SHA1

18bf034906c1341b7817e7361ad27a4425d820bd
SHA256

817a50d00909383bbef41e6f4e61b527d55f0873bcf745b29dbba75f52fe2e97
SHA512

d40e5f77d882ed29bd9de5a6848072e2f81cd02176955e2b1a4aedcdf4eb687d77bebe33cef0c7d702bc828181755f86e2564523d476adbb785f396a5ce1d474

Score

8^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 10 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral5/files/0x0003000000013171-68.dat	aspack_v212_v242
behavioral5/files/0x0003000000013171-70.dat	aspack_v212_v242
behavioral5/files/0x0003000000013171-69.dat	aspack_v212_v242
behavioral5/files/0x0003000000013171-72.dat	aspack_v212_v242
behavioral5/files/0x000300000001315c-76.dat	aspack_v212_v242
behavioral5/files/0x000300000001315c-75.dat	aspack_v212_v242
behavioral5/files/0x000300000001315b-77.dat	aspack_v212_v242
behavioral5/files/0x000300000001315b-78.dat	aspack_v212_v242
behavioral5/files/0x0003000000013160-81.dat	aspack_v212_v242
behavioral5/files/0x0003000000013160-82.dat	aspack_v212_v242

Executes dropped EXE 2 IoCs

pid	Process
1476	setup_installer.exe
1584	setup_install.exe

Loads dropped DLL 12 IoCs

pid	Process
1816	8 (11).exe
1476	setup_installer.exe
1476	setup_installer.exe
1476	setup_installer.exe
1476	setup_installer.exe
1476	setup_installer.exe
1476	setup_installer.exe
1584	setup_install.exe
1584	setup_install.exe
1584	setup_install.exe
1584	setup_install.exe
1584	setup_install.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 1476	1816	8 (11).exe	26
PID 1816 wrote to memory of 1476	1816	8 (11).exe	26
PID 1816 wrote to memory of 1476	1816	8 (11).exe	26
PID 1816 wrote to memory of 1476	1816	8 (11).exe	26
PID 1816 wrote to memory of 1476	1816	8 (11).exe	26
PID 1816 wrote to memory of 1476	1816	8 (11).exe	26
PID 1816 wrote to memory of 1476	1816	8 (11).exe	26
PID 1476 wrote to memory of 1584	1476	setup_installer.exe	30
PID 1476 wrote to memory of 1584	1476	setup_installer.exe	30
PID 1476 wrote to memory of 1584	1476	setup_installer.exe	30
PID 1476 wrote to memory of 1584	1476	setup_installer.exe	30
PID 1476 wrote to memory of 1584	1476	setup_installer.exe	30
PID 1476 wrote to memory of 1584	1476	setup_installer.exe	30
PID 1476 wrote to memory of 1584	1476	setup_installer.exe	30

C:\Users\Admin\AppData\Local\Temp\8 (11).exe
"C:\Users\Admin\AppData\Local\Temp\8 (11).exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Users\Admin\AppData\Local\Temp\7zS4C5286C4\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS4C5286C4\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1816-59-0x0000000075EF1000-0x0000000075EF3000-memory.dmp

Filesize
8KB

Download

Resubmissions

Analysis

Sharing

General