dc60ba75ab28673636dfb2bd57a65261c9841f94ff20c15c24e323f2e749876b

Analysis

max time kernel
147s
max time network
151s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
07/07/2023, 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a08ded5458368exeexeexeex.exe
Size

58KB
MD5

5a08ded54583683f9bc317a2f3923905
SHA1

7b0dd1bd35a74b1212d0332404284b01fb366e5b
SHA256

dc60ba75ab28673636dfb2bd57a65261c9841f94ff20c15c24e323f2e749876b
SHA512

85c971de1ad7f3aa6ec90e1eed181cc6a09001689fa10b48ebdd67ac3a84d905e4ac1dab134daf723184e0e3b63ca236ea9d364c37bfdd7a557f238c09f16ac7
SSDEEP

768:XS5nQJ24LR1bytOOtEvwDpjNbZ7uyA36S7MpxRXrY:i5nkFGMOtEvwDpjNbwQEIs

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2368	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2292	5a08ded5458368exeexeexeex.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2368	2292	5a08ded5458368exeexeexeex.exe	29
PID 2292 wrote to memory of 2368	2292	5a08ded5458368exeexeexeex.exe	29
PID 2292 wrote to memory of 2368	2292	5a08ded5458368exeexeexeex.exe	29
PID 2292 wrote to memory of 2368	2292	5a08ded5458368exeexeexeex.exe	29

C:\Users\Admin\AppData\Local\Temp\5a08ded5458368exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\5a08ded5458368exeexeexeex.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
58KB

MD5
98cbda19a59a6ba571a3fe1afbab66ff

SHA1
9f077fb429a7b0150d0813fba8e38614dbb88733

SHA256
d3419045232aa512edd72193a01d2227cf3924ce17f6beefd705882e7a42af61

SHA512
c066faa133f5145bf2e4cf6c9afa33e9943c8db8f1f1fdbc6aa1b0ef3f7a0676bc88e39eb373740a3c0a185794d1ce90a0ce0b892edc672999f45f6f9105b9bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
58KB

MD5
98cbda19a59a6ba571a3fe1afbab66ff

SHA1
9f077fb429a7b0150d0813fba8e38614dbb88733

SHA256
d3419045232aa512edd72193a01d2227cf3924ce17f6beefd705882e7a42af61

SHA512
c066faa133f5145bf2e4cf6c9afa33e9943c8db8f1f1fdbc6aa1b0ef3f7a0676bc88e39eb373740a3c0a185794d1ce90a0ce0b892edc672999f45f6f9105b9bb

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
58KB

MD5
98cbda19a59a6ba571a3fe1afbab66ff

SHA1
9f077fb429a7b0150d0813fba8e38614dbb88733

SHA256
d3419045232aa512edd72193a01d2227cf3924ce17f6beefd705882e7a42af61

SHA512
c066faa133f5145bf2e4cf6c9afa33e9943c8db8f1f1fdbc6aa1b0ef3f7a0676bc88e39eb373740a3c0a185794d1ce90a0ce0b892edc672999f45f6f9105b9bb

Download Submit
memory/2292-54-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2292-55-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download
memory/2292-66-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2368-69-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/2368-76-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download