04097181cf21d9fed0fae0539d30812e2c32347f10bd061d9cc7174ade8e6bc1

Analysis

max time kernel
151s
max time network
157s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
06/07/2023, 13:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cefa145c18cc4dexeexeexeex.exe
Size

91KB
MD5

cefa145c18cc4de149604b3aacbcb622
SHA1

58a72b9dd0f5bdfa7b92c37644c06e371060ac8b
SHA256

04097181cf21d9fed0fae0539d30812e2c32347f10bd061d9cc7174ade8e6bc1
SHA512

d9e983ffd91f4603a32f1df2250271e1a63937c4addd696f3fe044150f1de2451caabae7d6033b2e126bf46ba133a8a86e6a4d3552c47e8008b6fe621a360189
SSDEEP

1536:zj+soPSMOtEvwDpj4ktBl01hJl8QAPM8Ho6cRDjuvM:zCsanOtEvwDpjE

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2212	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
3064	cefa145c18cc4dexeexeexeex.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3064-62-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x000a00000001228a-64.dat	upx
behavioral1/files/0x000a00000001228a-67.dat	upx
behavioral1/files/0x000a00000001228a-75.dat	upx
behavioral1/memory/2212-76-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2212	3064	cefa145c18cc4dexeexeexeex.exe	28
PID 3064 wrote to memory of 2212	3064	cefa145c18cc4dexeexeexeex.exe	28
PID 3064 wrote to memory of 2212	3064	cefa145c18cc4dexeexeexeex.exe	28
PID 3064 wrote to memory of 2212	3064	cefa145c18cc4dexeexeexeex.exe	28

C:\Users\Admin\AppData\Local\Temp\cefa145c18cc4dexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\cefa145c18cc4dexeexeexeex.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2212

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
91KB

MD5
4451af34648acdee8ff076101b20f9ae

SHA1
1dddd1f1c1482542792e38eb0a3cf69556bb2a1f

SHA256
f5820d577b6d4e453c0d9b0c1de511329c91f4e74549448cad260a171b0523e0

SHA512
0198c76804e3ed4a3188a92d2b1262384ecdb1b7a87ae471ed21160791c79b3506cc4361b3bd277563900c460f0b0be7a57ab448f60d2be1f430bb695b830537

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
91KB

MD5
4451af34648acdee8ff076101b20f9ae

SHA1
1dddd1f1c1482542792e38eb0a3cf69556bb2a1f

SHA256
f5820d577b6d4e453c0d9b0c1de511329c91f4e74549448cad260a171b0523e0

SHA512
0198c76804e3ed4a3188a92d2b1262384ecdb1b7a87ae471ed21160791c79b3506cc4361b3bd277563900c460f0b0be7a57ab448f60d2be1f430bb695b830537

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
91KB

MD5
4451af34648acdee8ff076101b20f9ae

SHA1
1dddd1f1c1482542792e38eb0a3cf69556bb2a1f

SHA256
f5820d577b6d4e453c0d9b0c1de511329c91f4e74549448cad260a171b0523e0

SHA512
0198c76804e3ed4a3188a92d2b1262384ecdb1b7a87ae471ed21160791c79b3506cc4361b3bd277563900c460f0b0be7a57ab448f60d2be1f430bb695b830537

Download Submit
memory/2212-69-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2212-76-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3064-54-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/3064-55-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/3064-62-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download