fe7b1e4f1050ab936f846e518e833fedde328faf84032172d166a89a9c9c4b85

Analysis

max time kernel
146s
max time network
149s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
08/07/2023, 17:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88030af2458f8cexeexeexeex.exe
Size

90KB
MD5

88030af2458f8c026e9553e6257d22ad
SHA1

98af80af0ec535fba4a553e5dbbad20f3d03dc81
SHA256

fe7b1e4f1050ab936f846e518e833fedde328faf84032172d166a89a9c9c4b85
SHA512

cdfa5742445e4ebbca913775f82da8bb906e396b8eb7f5574c7f23c9501b3174914cd03fa2de1fa6fe6f86ba8e6f992fb6ef3e84f612a85d20aa39fb69a2948c
SSDEEP

1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgpMx7a:AnBdOOtEvwDpj6za

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2420	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2272	88030af2458f8cexeexeexeex.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000d00000001225d-63.dat	upx
behavioral1/files/0x000d00000001225d-67.dat	upx
behavioral1/memory/2272-66-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral1/files/0x000d00000001225d-75.dat	upx
behavioral1/memory/2420-76-0x0000000000500000-0x000000000050F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2420	2272	88030af2458f8cexeexeexeex.exe	29
PID 2272 wrote to memory of 2420	2272	88030af2458f8cexeexeexeex.exe	29
PID 2272 wrote to memory of 2420	2272	88030af2458f8cexeexeexeex.exe	29
PID 2272 wrote to memory of 2420	2272	88030af2458f8cexeexeexeex.exe	29

C:\Users\Admin\AppData\Local\Temp\88030af2458f8cexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\88030af2458f8cexeexeexeex.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2420

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
90KB

MD5
daa437ff7013e98bbe19663bced6880c

SHA1
e58ad8eb6d2bec903c57b7cc61c465d52b5ccf61

SHA256
f57dc5bdd373c0ec3445833da91074bb8a49d60be3cc5a87fbc365c0eb4722a1

SHA512
524ef29d2a71920ce3f4a256b4783aa4b43661c81cf63b77f1966428a807fa8458f087797980d21baa6d561f1647dd1b720cbaa9577181e2fcd8195aafcdb2a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
90KB

MD5
daa437ff7013e98bbe19663bced6880c

SHA1
e58ad8eb6d2bec903c57b7cc61c465d52b5ccf61

SHA256
f57dc5bdd373c0ec3445833da91074bb8a49d60be3cc5a87fbc365c0eb4722a1

SHA512
524ef29d2a71920ce3f4a256b4783aa4b43661c81cf63b77f1966428a807fa8458f087797980d21baa6d561f1647dd1b720cbaa9577181e2fcd8195aafcdb2a9

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
90KB

MD5
daa437ff7013e98bbe19663bced6880c

SHA1
e58ad8eb6d2bec903c57b7cc61c465d52b5ccf61

SHA256
f57dc5bdd373c0ec3445833da91074bb8a49d60be3cc5a87fbc365c0eb4722a1

SHA512
524ef29d2a71920ce3f4a256b4783aa4b43661c81cf63b77f1966428a807fa8458f087797980d21baa6d561f1647dd1b720cbaa9577181e2fcd8195aafcdb2a9

Download Submit
memory/2272-54-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2272-55-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download
memory/2272-66-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2420-69-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2420-76-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download