3149587f92ceb44350580ad52450ab5953dc2c7b8edabc1aef3c5088d82ffcbb

Analysis

max time kernel
133s
max time network
145s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
13/07/2023, 18:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

036816d83d3d5dexe_JC.exe
Size

53KB
MD5

036816d83d3d5d01833dfe594c8f79b5
SHA1

e738a7cb813931135dc0e09c10f6575d0ab0f202
SHA256

3149587f92ceb44350580ad52450ab5953dc2c7b8edabc1aef3c5088d82ffcbb
SHA512

3540c35e574b88f096446c5e6d2548189364a2887a42ff031facecd552f896174f609dd7ab91fa814451f5d14c4e937df4c0eda6017b27df5103ff1735cda267
SSDEEP

1536:X6QFElP6n+gJQMOtEvwDpjBccD2RuoNmuBLM:X6a+SOtEvwDpjBrOO

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
692	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2564	036816d83d3d5dexe_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 692	2564	036816d83d3d5dexe_JC.exe	28
PID 2564 wrote to memory of 692	2564	036816d83d3d5dexe_JC.exe	28
PID 2564 wrote to memory of 692	2564	036816d83d3d5dexe_JC.exe	28
PID 2564 wrote to memory of 692	2564	036816d83d3d5dexe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\036816d83d3d5dexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\036816d83d3d5dexe_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
53KB

MD5
ee49fbb9308683d88e6bde2400ddf553

SHA1
56bb447e5f527835dfa59e31b619ba871c26eafe

SHA256
1c8ab024e06e8d2426cf3e033e449777342ecdb46616474b011fbb12a1c39a2a

SHA512
884a3c886be293cb2d41153169b887676c4d03aa3fc8fd029a7198d5bc84c2e0469324a314d5d3fb51c37130cc45d60495180f78de22d7d31db07f96eb1648a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
53KB

MD5
ee49fbb9308683d88e6bde2400ddf553

SHA1
56bb447e5f527835dfa59e31b619ba871c26eafe

SHA256
1c8ab024e06e8d2426cf3e033e449777342ecdb46616474b011fbb12a1c39a2a

SHA512
884a3c886be293cb2d41153169b887676c4d03aa3fc8fd029a7198d5bc84c2e0469324a314d5d3fb51c37130cc45d60495180f78de22d7d31db07f96eb1648a1

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
53KB

MD5
ee49fbb9308683d88e6bde2400ddf553

SHA1
56bb447e5f527835dfa59e31b619ba871c26eafe

SHA256
1c8ab024e06e8d2426cf3e033e449777342ecdb46616474b011fbb12a1c39a2a

SHA512
884a3c886be293cb2d41153169b887676c4d03aa3fc8fd029a7198d5bc84c2e0469324a314d5d3fb51c37130cc45d60495180f78de22d7d31db07f96eb1648a1

Download Submit
memory/692-68-0x00000000003F0000-0x00000000003F6000-memory.dmp

Filesize
24KB

Download
memory/692-69-0x00000000003C0000-0x00000000003C6000-memory.dmp

Filesize
24KB

Download
memory/2564-53-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2564-55-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2564-54-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download