f24a2c639bd12c10f2e77635530121d25df5c3013e0530f542a20990e00d1696

Analysis

max time kernel
141s
max time network
141s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
17/07/2023, 12:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8370944043324c_JC.exe
Size

90KB
MD5

8370944043324c4320f5d162ed117363
SHA1

5182392ae0889b87804d33fe67f000d78806743e
SHA256

f24a2c639bd12c10f2e77635530121d25df5c3013e0530f542a20990e00d1696
SHA512

01f29e70b6b25879298f8caec8af958a0862878bdf1efbe435c81806ca4df16fdba7f2800f00e56b62c9f64b6babc93ce5cdd89e71dc945429d67d582dbbb881
SSDEEP

1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgpMx7h:AnBdOOtEvwDpj6zh

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2904	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1612	8370944043324c_JC.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1612-54-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral1/files/0x0008000000012026-65.dat	upx
behavioral1/memory/1612-69-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral1/memory/2904-71-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral1/files/0x0008000000012026-70.dat	upx
behavioral1/files/0x0008000000012026-80.dat	upx
behavioral1/memory/2904-81-0x0000000000500000-0x000000000050F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2904	1612	8370944043324c_JC.exe	28
PID 1612 wrote to memory of 2904	1612	8370944043324c_JC.exe	28
PID 1612 wrote to memory of 2904	1612	8370944043324c_JC.exe	28
PID 1612 wrote to memory of 2904	1612	8370944043324c_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\8370944043324c_JC.exe
"C:\Users\Admin\AppData\Local\Temp\8370944043324c_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
90KB

MD5
f33afca3f1cde50692e016b6988408fa

SHA1
68f1a1c79ee880da470b4b6bf7c3e8f4d597177f

SHA256
59d88b13e1c52db3ec94814a16b28224cfffce534fca73672a0f7fedc26d6acb

SHA512
2e31365ee90fd481dcf1299e047a6d43a18bc70b76311e8de28f0800b1d9ba151d9eb1d31711a1bea0cc18fd7095deb64bf71a2de9a260c1ea132334b6d3a443

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
90KB

MD5
f33afca3f1cde50692e016b6988408fa

SHA1
68f1a1c79ee880da470b4b6bf7c3e8f4d597177f

SHA256
59d88b13e1c52db3ec94814a16b28224cfffce534fca73672a0f7fedc26d6acb

SHA512
2e31365ee90fd481dcf1299e047a6d43a18bc70b76311e8de28f0800b1d9ba151d9eb1d31711a1bea0cc18fd7095deb64bf71a2de9a260c1ea132334b6d3a443

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
90KB

MD5
f33afca3f1cde50692e016b6988408fa

SHA1
68f1a1c79ee880da470b4b6bf7c3e8f4d597177f

SHA256
59d88b13e1c52db3ec94814a16b28224cfffce534fca73672a0f7fedc26d6acb

SHA512
2e31365ee90fd481dcf1299e047a6d43a18bc70b76311e8de28f0800b1d9ba151d9eb1d31711a1bea0cc18fd7095deb64bf71a2de9a260c1ea132334b6d3a443

Download Submit
memory/1612-68-0x0000000002800000-0x000000000280F000-memory.dmp

Filesize
60KB

Download
memory/1612-58-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1612-69-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1612-54-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1612-56-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/1612-55-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2904-71-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2904-74-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2904-73-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2904-81-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download