2fc3008e382feea9f678636409b1ca9932cbc4e01260acb6541a12828ffec214

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20230705-en
resource tags

arch:x64arch:x86image:win7-20230705-enlocale:en-usos:windows7-x64system
submitted
08/07/2023, 17:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87598d9cc4bc46exeexeexeex.exe
Size

56KB
MD5

87598d9cc4bc46228fe863d40296382b
SHA1

84f2de7adbd8d48073d4f3968aa1a899a3170388
SHA256

2fc3008e382feea9f678636409b1ca9932cbc4e01260acb6541a12828ffec214
SHA512

a927e920ce0244bea255a477be168c93be8c40f13c76a7bf0f179f2b786b265e8793a60240f15c627e9ae91e66a1924a237287285360f49e829cf6cc62493fa0
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjIm8lB4dCOBy/cMFqeo9e1jR4llT:ZzFbxmLPWQMOtEvwDpj38lD/cMAPm8lT

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2000	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2192	87598d9cc4bc46exeexeexeex.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2000	2192	87598d9cc4bc46exeexeexeex.exe	27
PID 2192 wrote to memory of 2000	2192	87598d9cc4bc46exeexeexeex.exe	27
PID 2192 wrote to memory of 2000	2192	87598d9cc4bc46exeexeexeex.exe	27
PID 2192 wrote to memory of 2000	2192	87598d9cc4bc46exeexeexeex.exe	27

C:\Users\Admin\AppData\Local\Temp\87598d9cc4bc46exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\87598d9cc4bc46exeexeexeex.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
56KB

MD5
e0e3d8daa0f830b497492b4b022e28cb

SHA1
c459e7e6d291b0b31e35e6ae6bb828a85b3cf246

SHA256
c21e5ce20408d45dae68a106f2699f3ac197ea01b5be3ef74923f8a653b78e5d

SHA512
fdf659833473e07c667757c50b565654fbd9250278a78ffa85fc320152e9cc4c2226a608f61c5d41837a3e1db2e429852fa502bd0b08294b99a9dcae91ca1635

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
56KB

MD5
e0e3d8daa0f830b497492b4b022e28cb

SHA1
c459e7e6d291b0b31e35e6ae6bb828a85b3cf246

SHA256
c21e5ce20408d45dae68a106f2699f3ac197ea01b5be3ef74923f8a653b78e5d

SHA512
fdf659833473e07c667757c50b565654fbd9250278a78ffa85fc320152e9cc4c2226a608f61c5d41837a3e1db2e429852fa502bd0b08294b99a9dcae91ca1635

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
56KB

MD5
e0e3d8daa0f830b497492b4b022e28cb

SHA1
c459e7e6d291b0b31e35e6ae6bb828a85b3cf246

SHA256
c21e5ce20408d45dae68a106f2699f3ac197ea01b5be3ef74923f8a653b78e5d

SHA512
fdf659833473e07c667757c50b565654fbd9250278a78ffa85fc320152e9cc4c2226a608f61c5d41837a3e1db2e429852fa502bd0b08294b99a9dcae91ca1635

Download Submit
memory/2000-69-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2192-54-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/2192-55-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2192-62-0x0000000000230000-0x00000000002B0000-memory.dmp

Filesize
512KB

Download