c96be7f4a4b6f672faaeb87391b04632ed21be75d8038d467047893e580cef87

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
08/07/2023, 10:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b17986b733cf4exeexeexeex.exe
Size

77KB
MD5

6b17986b733cf4d3ea0f39c951a747b9
SHA1

494d61ff17cfbb5ce4d9486f547941a299c6700f
SHA256

c96be7f4a4b6f672faaeb87391b04632ed21be75d8038d467047893e580cef87
SHA512

355a2dbe611e07ceaa9b6bcfd114de371b027c76f009933755826d09fff80508fd1d83c9f060fdf51c0d8eedb021f0d0425a8b0826d8b21666eda48509c921b7
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpj/MLa5VccPtNw5CS95yJYbf:V6QFElP6n+gMQMOtEvwDpjyaLccVNlCL

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1108	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2200	6b17986b733cf4exeexeexeex.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 1108	2200	6b17986b733cf4exeexeexeex.exe	29
PID 2200 wrote to memory of 1108	2200	6b17986b733cf4exeexeexeex.exe	29
PID 2200 wrote to memory of 1108	2200	6b17986b733cf4exeexeexeex.exe	29
PID 2200 wrote to memory of 1108	2200	6b17986b733cf4exeexeexeex.exe	29

C:\Users\Admin\AppData\Local\Temp\6b17986b733cf4exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\6b17986b733cf4exeexeexeex.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
77KB

MD5
98ddc99b740c633144ab024416edf053

SHA1
8c91347a56ce3453e444d9a954b66b1a712bc509

SHA256
d081ce49571b33f1bdaffce64b528b2c8aaf656cc18b056e14bd6cc785ba39a1

SHA512
54f82ec432bfda325f9d180c88daec4266e26c28077df266a1259ee132867ba9b7c52981596ba60b79f5c1b52bf999a3654d8adab3d53bcd1849eb008ac1cede

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
77KB

MD5
98ddc99b740c633144ab024416edf053

SHA1
8c91347a56ce3453e444d9a954b66b1a712bc509

SHA256
d081ce49571b33f1bdaffce64b528b2c8aaf656cc18b056e14bd6cc785ba39a1

SHA512
54f82ec432bfda325f9d180c88daec4266e26c28077df266a1259ee132867ba9b7c52981596ba60b79f5c1b52bf999a3654d8adab3d53bcd1849eb008ac1cede

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
77KB

MD5
98ddc99b740c633144ab024416edf053

SHA1
8c91347a56ce3453e444d9a954b66b1a712bc509

SHA256
d081ce49571b33f1bdaffce64b528b2c8aaf656cc18b056e14bd6cc785ba39a1

SHA512
54f82ec432bfda325f9d180c88daec4266e26c28077df266a1259ee132867ba9b7c52981596ba60b79f5c1b52bf999a3654d8adab3d53bcd1849eb008ac1cede

Download Submit
memory/1108-68-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2200-54-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download
memory/2200-55-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download