1c0e776025d9a4708da0f62a871fd758923af1e2a51d639a9f0b4ff0d95670d9

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
10/07/2023, 17:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d4bb38423c0850exeexeexeex.exe
Size

47KB
MD5

d4bb38423c085025e5cba4cfbc6fc8a3
SHA1

ec70ade6506d1edc121967502c036f33baebbdf3
SHA256

1c0e776025d9a4708da0f62a871fd758923af1e2a51d639a9f0b4ff0d95670d9
SHA512

60059e864e0b014a6fe74071dcae3f269b730f07bf81d2b0d2b13369a17a7245e3b7afc22d9cd3f5969ad987e26457d4bca344f03a03482b9abc77511d9f2b37
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjZ1UKXJ0ToBpK223lDE:ZzFbxmLPWQMOtEvwDpjbtJ0gATY

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1860	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2200	d4bb38423c0850exeexeexeex.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 1860	2200	d4bb38423c0850exeexeexeex.exe	29
PID 2200 wrote to memory of 1860	2200	d4bb38423c0850exeexeexeex.exe	29
PID 2200 wrote to memory of 1860	2200	d4bb38423c0850exeexeexeex.exe	29
PID 2200 wrote to memory of 1860	2200	d4bb38423c0850exeexeexeex.exe	29

C:\Users\Admin\AppData\Local\Temp\d4bb38423c0850exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\d4bb38423c0850exeexeexeex.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
47KB

MD5
fa78d52b752921f87dfdd1e9f9fa6337

SHA1
8271324629d9839d636b911a898434273c8d1376

SHA256
83f4c3653821c177cba79be108aff9d6c193c12e9e95956b886f611c28ea9490

SHA512
c9a3391b0e7cd0e322ec9f5bc2d68a66f421329d97b369faa8362e0e43951337e7f3eeccb20de4707625c44dc5489c1071bbe9331eb26ef4109d98fb3fa4207e

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
47KB

MD5
fa78d52b752921f87dfdd1e9f9fa6337

SHA1
8271324629d9839d636b911a898434273c8d1376

SHA256
83f4c3653821c177cba79be108aff9d6c193c12e9e95956b886f611c28ea9490

SHA512
c9a3391b0e7cd0e322ec9f5bc2d68a66f421329d97b369faa8362e0e43951337e7f3eeccb20de4707625c44dc5489c1071bbe9331eb26ef4109d98fb3fa4207e

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
47KB

MD5
fa78d52b752921f87dfdd1e9f9fa6337

SHA1
8271324629d9839d636b911a898434273c8d1376

SHA256
83f4c3653821c177cba79be108aff9d6c193c12e9e95956b886f611c28ea9490

SHA512
c9a3391b0e7cd0e322ec9f5bc2d68a66f421329d97b369faa8362e0e43951337e7f3eeccb20de4707625c44dc5489c1071bbe9331eb26ef4109d98fb3fa4207e

Download Submit
memory/1860-68-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/2200-54-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/2200-55-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download