2e57ec86a023e93d113ebac60c7c833ddf3c93860e0d88c5448435414eec4228

Analysis

max time kernel
154s
max time network
183s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
08/07/2023, 18:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9cf0d4d12422efexeexeexeex.exe
Size

48KB
MD5

9cf0d4d12422ef9ed2ffcfb2a41648bb
SHA1

9583c81f23566fe5af1965384ade07d2ba8fcbf9
SHA256

2e57ec86a023e93d113ebac60c7c833ddf3c93860e0d88c5448435414eec4228
SHA512

27cfdc841a9654070eea95f8c1de14a1969aba8caf833a86d08606a168d0c51f6c552f77fde81dbaf8052b8251ef821ce8c1e3590c128b2698e809157facfe89
SSDEEP

768:bIDOw9UiaCHfjnE0Sfa7ilR0p9u6p4Uu6EIEIDKlPopW:bIDOw9a0DwitDwIzDKlPopW

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
860	lossy.exe

Loads dropped DLL 1 IoCs

pid	Process
1592	9cf0d4d12422efexeexeexeex.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 860	1592	9cf0d4d12422efexeexeexeex.exe	29
PID 1592 wrote to memory of 860	1592	9cf0d4d12422efexeexeexeex.exe	29
PID 1592 wrote to memory of 860	1592	9cf0d4d12422efexeexeexeex.exe	29
PID 1592 wrote to memory of 860	1592	9cf0d4d12422efexeexeexeex.exe	29

C:\Users\Admin\AppData\Local\Temp\9cf0d4d12422efexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\9cf0d4d12422efexeexeexeex.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  PID:860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
48KB

MD5
e0d9411035d65ed58173034a60c5383b

SHA1
4a5d41ce84f5be29425b9b6d642d3bfd5809684c

SHA256
c3aef74ea6f7d0e21c5d03f5a09e4e98963710515c5fd21303f2c293e97e6304

SHA512
c122098289ce2ce4c63e13a5dda0af5b8a217ee59d5ff3b3c9155d4392b8ba4a4879f1b3fc73370d2327ffa65285ca4d68744f921c62a75ca4a0d46a639e16a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
48KB

MD5
e0d9411035d65ed58173034a60c5383b

SHA1
4a5d41ce84f5be29425b9b6d642d3bfd5809684c

SHA256
c3aef74ea6f7d0e21c5d03f5a09e4e98963710515c5fd21303f2c293e97e6304

SHA512
c122098289ce2ce4c63e13a5dda0af5b8a217ee59d5ff3b3c9155d4392b8ba4a4879f1b3fc73370d2327ffa65285ca4d68744f921c62a75ca4a0d46a639e16a9

Download Submit
\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
48KB

MD5
e0d9411035d65ed58173034a60c5383b

SHA1
4a5d41ce84f5be29425b9b6d642d3bfd5809684c

SHA256
c3aef74ea6f7d0e21c5d03f5a09e4e98963710515c5fd21303f2c293e97e6304

SHA512
c122098289ce2ce4c63e13a5dda0af5b8a217ee59d5ff3b3c9155d4392b8ba4a4879f1b3fc73370d2327ffa65285ca4d68744f921c62a75ca4a0d46a639e16a9

Download Submit
memory/860-68-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/1592-54-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1592-55-0x0000000000550000-0x0000000000556000-memory.dmp

Filesize
24KB

Download