ec4ba74b1a04a238c28ea5ca7ff8dcbc6cff5e13a65cff6abc20b607e20220ce

Analysis

max time kernel
141s
max time network
145s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
16/07/2023, 07:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56e6ab8e345765_JC.exe
Size

98KB
MD5

56e6ab8e345765924d685ab8383bf96f
SHA1

ea6a1a31beb17ef2ae15f597d1211b37efc33d20
SHA256

ec4ba74b1a04a238c28ea5ca7ff8dcbc6cff5e13a65cff6abc20b607e20220ce
SHA512

6e40ce39a0cc5841c1d768329545fd91d2ceae74d0e330126d2c1782bf0684b55c0709313b65fe342bb666e5560e49d0425fbf4a51939862e5ee023708f66767
SSDEEP

1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgpQbCJjLyVl:AnBdOOtEvwDpj6zv

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
932	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1460	56e6ab8e345765_JC.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1460-54-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral1/memory/1460-69-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral1/files/0x000a000000012024-70.dat	upx
behavioral1/files/0x000a000000012024-65.dat	upx
behavioral1/memory/932-71-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral1/files/0x000a000000012024-80.dat	upx
behavioral1/memory/932-81-0x0000000000500000-0x000000000050F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 932	1460	56e6ab8e345765_JC.exe	30
PID 1460 wrote to memory of 932	1460	56e6ab8e345765_JC.exe	30
PID 1460 wrote to memory of 932	1460	56e6ab8e345765_JC.exe	30
PID 1460 wrote to memory of 932	1460	56e6ab8e345765_JC.exe	30

C:\Users\Admin\AppData\Local\Temp\56e6ab8e345765_JC.exe
"C:\Users\Admin\AppData\Local\Temp\56e6ab8e345765_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
98KB

MD5
ea20fcb8122ba89a20a71e29b0eadf63

SHA1
9e749c546b3b45c68048ffe11f22403b07ebb6df

SHA256
5fbe73fa5cbd6e7f551a9bbfca0be4b17de45c6e42a3a8c8f97a273f12f9539d

SHA512
ec1d822de26c99d3d9e44f145fe070b4b77b9f62a42b2000ce7b781073712c6d4cd3a0bd474b5903d3ab898f0356305da42501e0d9bb2239b11ae982bcdc5882

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
98KB

MD5
ea20fcb8122ba89a20a71e29b0eadf63

SHA1
9e749c546b3b45c68048ffe11f22403b07ebb6df

SHA256
5fbe73fa5cbd6e7f551a9bbfca0be4b17de45c6e42a3a8c8f97a273f12f9539d

SHA512
ec1d822de26c99d3d9e44f145fe070b4b77b9f62a42b2000ce7b781073712c6d4cd3a0bd474b5903d3ab898f0356305da42501e0d9bb2239b11ae982bcdc5882

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
98KB

MD5
ea20fcb8122ba89a20a71e29b0eadf63

SHA1
9e749c546b3b45c68048ffe11f22403b07ebb6df

SHA256
5fbe73fa5cbd6e7f551a9bbfca0be4b17de45c6e42a3a8c8f97a273f12f9539d

SHA512
ec1d822de26c99d3d9e44f145fe070b4b77b9f62a42b2000ce7b781073712c6d4cd3a0bd474b5903d3ab898f0356305da42501e0d9bb2239b11ae982bcdc5882

Download Submit
memory/932-73-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/932-71-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/932-74-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/932-81-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1460-67-0x0000000001E60000-0x0000000001E6F000-memory.dmp

Filesize
60KB

Download
memory/1460-69-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1460-57-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1460-55-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1460-54-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1460-56-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download