89f0398816032611ceef0137d6fd4b86a234a8216ec22119ec9c348b03132a50

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
13/07/2023, 19:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0968770511761bexe_JC.exe
Size

63KB
MD5

0968770511761b7fc6f2add869473fe6
SHA1

8a07553d96270d2b168f44bf20f9681e427e3b79
SHA256

89f0398816032611ceef0137d6fd4b86a234a8216ec22119ec9c348b03132a50
SHA512

f1bf9ff5b443a1bda6c092e9170d8b66a0bd4a3c87dc7a0bf8f777c1d0bde0c1a3717535763505f0d1fc01e7897aff6a066a8660b22c68d4c6909ec0d8ae0f79
SSDEEP

1536:z6QFElP6n+gKmddpMOtEvwDpj9aYaFAvy:z6a+CdOOtEvwDpjQ5

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2356	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2520	0968770511761bexe_JC.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2520-54-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2520-68-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x0008000000012029-65.dat	upx
behavioral1/memory/2356-70-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x0008000000012029-69.dat	upx
behavioral1/files/0x0008000000012029-79.dat	upx
behavioral1/memory/2356-80-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2356	2520	0968770511761bexe_JC.exe	28
PID 2520 wrote to memory of 2356	2520	0968770511761bexe_JC.exe	28
PID 2520 wrote to memory of 2356	2520	0968770511761bexe_JC.exe	28
PID 2520 wrote to memory of 2356	2520	0968770511761bexe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\0968770511761bexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\0968770511761bexe_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2356

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
63KB

MD5
6dcdded920d4d7d89e03aec7bbdfbe38

SHA1
f86d9c48a8efcf15d431c78a06503f67b17686a6

SHA256
0711e0cb88ffd17bf3270a4d096106809debcb0151f981846a7fc9cc6e26bb84

SHA512
b02677b9f8325e2af09d6ac88627a7d35a946d198b8501d07719283fbb709f8a5b78134fd5af222d4836fdfd9e1789fb32d64a27eade170603d894fa31bf7301

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
63KB

MD5
6dcdded920d4d7d89e03aec7bbdfbe38

SHA1
f86d9c48a8efcf15d431c78a06503f67b17686a6

SHA256
0711e0cb88ffd17bf3270a4d096106809debcb0151f981846a7fc9cc6e26bb84

SHA512
b02677b9f8325e2af09d6ac88627a7d35a946d198b8501d07719283fbb709f8a5b78134fd5af222d4836fdfd9e1789fb32d64a27eade170603d894fa31bf7301

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
63KB

MD5
6dcdded920d4d7d89e03aec7bbdfbe38

SHA1
f86d9c48a8efcf15d431c78a06503f67b17686a6

SHA256
0711e0cb88ffd17bf3270a4d096106809debcb0151f981846a7fc9cc6e26bb84

SHA512
b02677b9f8325e2af09d6ac88627a7d35a946d198b8501d07719283fbb709f8a5b78134fd5af222d4836fdfd9e1789fb32d64a27eade170603d894fa31bf7301

Download Submit
memory/2356-70-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2356-72-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2356-73-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2356-80-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2520-54-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2520-55-0x00000000001E0000-0x00000000001E6000-memory.dmp

Filesize
24KB

Download
memory/2520-56-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2520-58-0x00000000001E0000-0x00000000001E6000-memory.dmp

Filesize
24KB

Download
memory/2520-68-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download