2b0b9ad16912992590b0510876ee4322bfb8d582b36eb51d744896e09300d5d5

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
06/07/2023, 17:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44d7ca7e4a2f90exeexeexeex.exe
Size

103KB
MD5

44d7ca7e4a2f900536e28795ab122890
SHA1

1e399c9a8f954c768b72eab24d4e04089531473d
SHA256

2b0b9ad16912992590b0510876ee4322bfb8d582b36eb51d744896e09300d5d5
SHA512

000d540699c577d59b0e7a59a208611e010b44f8f57d189e88cbae1a04a2589e95ffaea3bc40edaf4de26b428a6e6d47d42ef5224185cfcb3d94d1bd6189b1c6
SSDEEP

768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRiWCCyDLKASkjolKc:xj+VGMOtEvwDpjubwQEIie8+ASk9c

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1544	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1528	44d7ca7e4a2f90exeexeexeex.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 1544	1528	44d7ca7e4a2f90exeexeexeex.exe	28
PID 1528 wrote to memory of 1544	1528	44d7ca7e4a2f90exeexeexeex.exe	28
PID 1528 wrote to memory of 1544	1528	44d7ca7e4a2f90exeexeexeex.exe	28
PID 1528 wrote to memory of 1544	1528	44d7ca7e4a2f90exeexeexeex.exe	28

C:\Users\Admin\AppData\Local\Temp\44d7ca7e4a2f90exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\44d7ca7e4a2f90exeexeexeex.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
103KB

MD5
f7f69c62177783cb37fdfecf2c5938c0

SHA1
82d5cef81a8ac00e71e5cdc70c97d64f00affe57

SHA256
b56d94c4dfad027eae0c1104df6e708f511152cf99f9198c488c33074e03067b

SHA512
6bc8a003fda3b422d4ea873ffc125ddc258c354e4cd0fca186dc039a3ade95a55b3daa44551c1864de8119c394f58ecf187cea261431cace08efec05a5ab7898

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
103KB

MD5
f7f69c62177783cb37fdfecf2c5938c0

SHA1
82d5cef81a8ac00e71e5cdc70c97d64f00affe57

SHA256
b56d94c4dfad027eae0c1104df6e708f511152cf99f9198c488c33074e03067b

SHA512
6bc8a003fda3b422d4ea873ffc125ddc258c354e4cd0fca186dc039a3ade95a55b3daa44551c1864de8119c394f58ecf187cea261431cace08efec05a5ab7898

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
103KB

MD5
f7f69c62177783cb37fdfecf2c5938c0

SHA1
82d5cef81a8ac00e71e5cdc70c97d64f00affe57

SHA256
b56d94c4dfad027eae0c1104df6e708f511152cf99f9198c488c33074e03067b

SHA512
6bc8a003fda3b422d4ea873ffc125ddc258c354e4cd0fca186dc039a3ade95a55b3daa44551c1864de8119c394f58ecf187cea261431cace08efec05a5ab7898

Download Submit
memory/1528-54-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1528-55-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/1528-67-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1544-69-0x0000000000200000-0x0000000000206000-memory.dmp

Filesize
24KB

Download
memory/1544-76-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download