5a8a8fb0c0b89fe3f07d6a3e283026e5e78920990a5f5b91bdb8921d6714d31b

Analysis

max time kernel
142s
max time network
33s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
23-06-2023 19:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a8a8fb0c0b89fe3f07d6a3e283026e5e78920990a5f5b91bdb8921d6714d31b.exe
Size

1.9MB
MD5

e99ce83762e79788cea4dd7bd4268d88
SHA1

6ed8e60f0a8dd7659e403a154db5cbbc1ad14187
SHA256

5a8a8fb0c0b89fe3f07d6a3e283026e5e78920990a5f5b91bdb8921d6714d31b
SHA512

8dd726ec82b41ac1681c8f4abbbb03faef9cd3c01816dff2a3fd5a59057e7b0dba2d4f659617e6907a13e56b4a5a2484d990f0e7948e3c3aac45239b99081e51
SSDEEP

49152:II8fJYWziMG9ghV3YFIeKcoU6F4VdtrylUdI9/:aiWzib9oVeKcoU6F4TtrywIZ

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\RarSFX0\bdck.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\RarSFX0\bdck.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\RarSFX0\bdck.exe	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\RarSFX0\bdck.exe	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

bdck.exe

pid process

1656 bdck.exe

pid	process
1656	bdck.exe

Loads dropped DLL 2 IoCs

Processes:

5a8a8fb0c0b89fe3f07d6a3e283026e5e78920990a5f5b91bdb8921d6714d31b.exe

pid	process
1700	5a8a8fb0c0b89fe3f07d6a3e283026e5e78920990a5f5b91bdb8921d6714d31b.exe
1700	5a8a8fb0c0b89fe3f07d6a3e283026e5e78920990a5f5b91bdb8921d6714d31b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5a8a8fb0c0b89fe3f07d6a3e283026e5e78920990a5f5b91bdb8921d6714d31b.exe

description	pid	process	target process
PID 1700 wrote to memory of 1656	1700	5a8a8fb0c0b89fe3f07d6a3e283026e5e78920990a5f5b91bdb8921d6714d31b.exe	bdck.exe
PID 1700 wrote to memory of 1656	1700	5a8a8fb0c0b89fe3f07d6a3e283026e5e78920990a5f5b91bdb8921d6714d31b.exe	bdck.exe
PID 1700 wrote to memory of 1656	1700	5a8a8fb0c0b89fe3f07d6a3e283026e5e78920990a5f5b91bdb8921d6714d31b.exe	bdck.exe
PID 1700 wrote to memory of 1656	1700	5a8a8fb0c0b89fe3f07d6a3e283026e5e78920990a5f5b91bdb8921d6714d31b.exe	bdck.exe

C:\Users\Admin\AppData\Local\Temp\5a8a8fb0c0b89fe3f07d6a3e283026e5e78920990a5f5b91bdb8921d6714d31b.exe
"C:\Users\Admin\AppData\Local\Temp\5a8a8fb0c0b89fe3f07d6a3e283026e5e78920990a5f5b91bdb8921d6714d31b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1700

C:\Users\Admin\AppData\Local\Temp\RarSFX0\bdck.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\bdck.exe"
2⤵
- Executes dropped EXE
PID:1656

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\bdck.exe
Filesize
1.8MB

MD5
36838116462454d46b0c7b5de55a48fe

SHA1
b310836227d07b9961bb733be8545b457325b3c0

SHA256
31181ef89cad2bb0b1172a5384658f92973e2b81171a2d4db1644da742c5846f

SHA512
dd540fe3c2b0619788dfb799a3aeeed59722cac17202c9f75ae2d384dd26c56ae874597c5afe78d6b6bb676a9685dacf81306c63721bb28acfce9aa4dc7647cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\bdck.exe
Filesize
1.8MB

MD5
36838116462454d46b0c7b5de55a48fe

SHA1
b310836227d07b9961bb733be8545b457325b3c0

SHA256
31181ef89cad2bb0b1172a5384658f92973e2b81171a2d4db1644da742c5846f

SHA512
dd540fe3c2b0619788dfb799a3aeeed59722cac17202c9f75ae2d384dd26c56ae874597c5afe78d6b6bb676a9685dacf81306c63721bb28acfce9aa4dc7647cd

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\bdck.exe
Filesize
1.8MB

MD5
36838116462454d46b0c7b5de55a48fe

SHA1
b310836227d07b9961bb733be8545b457325b3c0

SHA256
31181ef89cad2bb0b1172a5384658f92973e2b81171a2d4db1644da742c5846f

SHA512
dd540fe3c2b0619788dfb799a3aeeed59722cac17202c9f75ae2d384dd26c56ae874597c5afe78d6b6bb676a9685dacf81306c63721bb28acfce9aa4dc7647cd

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\bdck.exe
Filesize
1.8MB

MD5
36838116462454d46b0c7b5de55a48fe

SHA1
b310836227d07b9961bb733be8545b457325b3c0

SHA256
31181ef89cad2bb0b1172a5384658f92973e2b81171a2d4db1644da742c5846f

SHA512
dd540fe3c2b0619788dfb799a3aeeed59722cac17202c9f75ae2d384dd26c56ae874597c5afe78d6b6bb676a9685dacf81306c63721bb28acfce9aa4dc7647cd

Download Submit
memory/1656-64-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/1656-66-0x0000000000400000-0x0000000000A62000-memory.dmp

Filesize
6.4MB

Download
memory/1700-65-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads