a0dfec391b477d802a789e58efb49323372b88c6d57caa6b0af5beee48a9318b

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
15/07/2023, 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3804ec0945bd45exeexe_JC.exe
Size

67KB
MD5

3804ec0945bd45662f08b518248a7934
SHA1

372e2a04b1cd2678898119ebde35d6c956b961be
SHA256

a0dfec391b477d802a789e58efb49323372b88c6d57caa6b0af5beee48a9318b
SHA512

60817849800acc59482584786947ca8857bf1045cabf07407423f6def0f4135d4b47cc7202478474bd79d6b51966789b6a7c92b18066050c2cb5be3d3cb46f89
SSDEEP

1536:79mqyNhQMOtEvwDpjBPY7xv3gnQe+OHF7a:RlqbOtEvwDpjBg9

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2776	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2428	3804ec0945bd45exeexe_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2776	2428	3804ec0945bd45exeexe_JC.exe	28
PID 2428 wrote to memory of 2776	2428	3804ec0945bd45exeexe_JC.exe	28
PID 2428 wrote to memory of 2776	2428	3804ec0945bd45exeexe_JC.exe	28
PID 2428 wrote to memory of 2776	2428	3804ec0945bd45exeexe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\3804ec0945bd45exeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\3804ec0945bd45exeexe_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2776

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
67KB

MD5
b77e1e3ab9347b6b9f15116ad4863705

SHA1
41b41f8359cdc41a0a5c6d2db78f24416309699e

SHA256
88a1da28f10bf0b214a305539a77dff1b5a04624b4c3f344db9c0d828025c10b

SHA512
de8fd7a11ccdc126245def133b5add224d6bc32c622a7f60c761f134b063405414c9fb581977bede3880cea05efa4fe1a4c16466cf9280f439d779fde10df3d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
67KB

MD5
b77e1e3ab9347b6b9f15116ad4863705

SHA1
41b41f8359cdc41a0a5c6d2db78f24416309699e

SHA256
88a1da28f10bf0b214a305539a77dff1b5a04624b4c3f344db9c0d828025c10b

SHA512
de8fd7a11ccdc126245def133b5add224d6bc32c622a7f60c761f134b063405414c9fb581977bede3880cea05efa4fe1a4c16466cf9280f439d779fde10df3d3

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
67KB

MD5
b77e1e3ab9347b6b9f15116ad4863705

SHA1
41b41f8359cdc41a0a5c6d2db78f24416309699e

SHA256
88a1da28f10bf0b214a305539a77dff1b5a04624b4c3f344db9c0d828025c10b

SHA512
de8fd7a11ccdc126245def133b5add224d6bc32c622a7f60c761f134b063405414c9fb581977bede3880cea05efa4fe1a4c16466cf9280f439d779fde10df3d3

Download Submit
memory/2428-54-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2428-56-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2428-55-0x00000000003A0000-0x00000000003A6000-memory.dmp

Filesize
24KB

Download
memory/2428-63-0x00000000003A0000-0x00000000003A6000-memory.dmp

Filesize
24KB

Download
memory/2428-69-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2776-72-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2776-71-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2776-79-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download