be0e3757c0e1a1944d004be2b3366cedec2265aa2f75e5df9a2f2fafc3524b51

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
15/07/2023, 13:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4959a496a442b3exeexe_JC.exe
Size

40KB
MD5

4959a496a442b3c2107e2ff8743389e2
SHA1

101d2cac36eb176a00f477e45bde241dbd3d5bb8
SHA256

be0e3757c0e1a1944d004be2b3366cedec2265aa2f75e5df9a2f2fafc3524b51
SHA512

87b59a877f4afb86838b283a19071aba6f937312a6e1fa79635f3022540f108672bb6bddafc41202f7890fd292195e556cee6f76ba3ec1834729261e8145bd95
SSDEEP

384:e/4wODQkzonAYsju5N/surDQtOOtEvwDpjqIGROqS/Wcd7Vxqc0OqE/:79inqyNR/QtOOtEvwDpjBKcpO9g/

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1380	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2528	4959a496a442b3exeexe_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 1380	2528	4959a496a442b3exeexe_JC.exe	28
PID 2528 wrote to memory of 1380	2528	4959a496a442b3exeexe_JC.exe	28
PID 2528 wrote to memory of 1380	2528	4959a496a442b3exeexe_JC.exe	28
PID 2528 wrote to memory of 1380	2528	4959a496a442b3exeexe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\4959a496a442b3exeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\4959a496a442b3exeexe_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1380

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
41KB

MD5
7b1f5330dec59d4f316d2ebb2c0a0148

SHA1
913b65b08255466bf7dcf64533f5e2cd644e0a59

SHA256
67af2d3e31456f88826748d79f7858ff2549b9343fd8a7d4a31b86b5b845b873

SHA512
a05eec7953dfb6e06eaf343a11450d694cbc415f3c1e5c46276f56fa40fb71665546b1cdbed7cf7672075664a9db49382a13c0d23fd16ba99ef115b4a3be799a

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
41KB

MD5
7b1f5330dec59d4f316d2ebb2c0a0148

SHA1
913b65b08255466bf7dcf64533f5e2cd644e0a59

SHA256
67af2d3e31456f88826748d79f7858ff2549b9343fd8a7d4a31b86b5b845b873

SHA512
a05eec7953dfb6e06eaf343a11450d694cbc415f3c1e5c46276f56fa40fb71665546b1cdbed7cf7672075664a9db49382a13c0d23fd16ba99ef115b4a3be799a

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
41KB

MD5
7b1f5330dec59d4f316d2ebb2c0a0148

SHA1
913b65b08255466bf7dcf64533f5e2cd644e0a59

SHA256
67af2d3e31456f88826748d79f7858ff2549b9343fd8a7d4a31b86b5b845b873

SHA512
a05eec7953dfb6e06eaf343a11450d694cbc415f3c1e5c46276f56fa40fb71665546b1cdbed7cf7672075664a9db49382a13c0d23fd16ba99ef115b4a3be799a

Download Submit
memory/1380-70-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1380-72-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/1380-73-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/1380-80-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2528-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2528-55-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2528-56-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/2528-57-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2528-68-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download