3f5c7808733c29e76b794420ba6729ae6d6ca524e504e57023556279741b6990

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7-20230705-en
resource tags

arch:x64arch:x86image:win7-20230705-enlocale:en-usos:windows7-x64system
submitted
10/07/2023, 15:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf36dbbce952fdexeexeexeex.exe
Size

32KB
MD5

cf36dbbce952fdf4e41704e2b13bb1bc
SHA1

fa8a30f49144555e98e8ad5962e3bf68e043fc01
SHA256

3f5c7808733c29e76b794420ba6729ae6d6ca524e504e57023556279741b6990
SHA512

2aa77ff05e6daf3eebc447d400cd54a5d3b77499672ef2b40979f0c8282ad39b63c29d1b98815bb612a34d404b0e183906c2835cbd7c91a1c0925bf66a869d11
SSDEEP

768:q0ZziOWwULueOSdE8tOOtEvwDpjeW00shzG:q0zizzOSxMOtEvwDpj/0dhi

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2336	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2192	cf36dbbce952fdexeexeexeex.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2336	2192	cf36dbbce952fdexeexeexeex.exe	27
PID 2192 wrote to memory of 2336	2192	cf36dbbce952fdexeexeexeex.exe	27
PID 2192 wrote to memory of 2336	2192	cf36dbbce952fdexeexeexeex.exe	27
PID 2192 wrote to memory of 2336	2192	cf36dbbce952fdexeexeexeex.exe	27

C:\Users\Admin\AppData\Local\Temp\cf36dbbce952fdexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\cf36dbbce952fdexeexeexeex.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2336

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
32KB

MD5
80d282c5a2076260394d747151f2c42e

SHA1
dc6fc23478743f10dceda6cee0b03d6c712b37d3

SHA256
824a4cb43c8008fc7b0e3c501a1561a598804f60a41757661d41ae4474d08e89

SHA512
3d31dacce291a4893d43d9e3ad420b2e989971ac290ea10e26325df3c9c6e5bd18ea815e2ff1988017ef2112105e7a18b9d74e1c483b0d87be3242fc83a5425d

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
32KB

MD5
80d282c5a2076260394d747151f2c42e

SHA1
dc6fc23478743f10dceda6cee0b03d6c712b37d3

SHA256
824a4cb43c8008fc7b0e3c501a1561a598804f60a41757661d41ae4474d08e89

SHA512
3d31dacce291a4893d43d9e3ad420b2e989971ac290ea10e26325df3c9c6e5bd18ea815e2ff1988017ef2112105e7a18b9d74e1c483b0d87be3242fc83a5425d

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
32KB

MD5
80d282c5a2076260394d747151f2c42e

SHA1
dc6fc23478743f10dceda6cee0b03d6c712b37d3

SHA256
824a4cb43c8008fc7b0e3c501a1561a598804f60a41757661d41ae4474d08e89

SHA512
3d31dacce291a4893d43d9e3ad420b2e989971ac290ea10e26325df3c9c6e5bd18ea815e2ff1988017ef2112105e7a18b9d74e1c483b0d87be3242fc83a5425d

Download Submit
memory/2192-54-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2192-55-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2192-67-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2336-69-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/2336-76-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download