ccd08bc70e2ea4ec48df957c1ac63ac46d13a2628832706e68ad73128fefb7ad

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
17/07/2023, 14:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d19c121d1ae01_JC.exe
Size

74KB
MD5

8d19c121d1ae01d0166eb9168062acf6
SHA1

4f07bee9735c453f7267f34de4ba81c329bb5562
SHA256

ccd08bc70e2ea4ec48df957c1ac63ac46d13a2628832706e68ad73128fefb7ad
SHA512

1a6e3ccbf4c34b7c781b3227bb4f3a51716992b2ba8a14ba3609c11a1c757f9f266a2eb951960851a7ba0fb342c451c7ec101ec554c5a365fddc26687d8572b5
SSDEEP

1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsalDS2:1nK6a+qdOOtEvwDpjo

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1524	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2060	8d19c121d1ae01_JC.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2060-54-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/files/0x0008000000012022-70.dat	upx
behavioral1/memory/2060-69-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/memory/1524-71-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/files/0x0008000000012022-65.dat	upx
behavioral1/files/0x0008000000012022-79.dat	upx
behavioral1/memory/1524-81-0x0000000000500000-0x000000000050F311-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 1524	2060	8d19c121d1ae01_JC.exe	28
PID 2060 wrote to memory of 1524	2060	8d19c121d1ae01_JC.exe	28
PID 2060 wrote to memory of 1524	2060	8d19c121d1ae01_JC.exe	28
PID 2060 wrote to memory of 1524	2060	8d19c121d1ae01_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\8d19c121d1ae01_JC.exe
"C:\Users\Admin\AppData\Local\Temp\8d19c121d1ae01_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1524

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
74KB

MD5
ce6c7b7664e4d731dca7e2500a17dad0

SHA1
52eacc99e4b150dd657db52d9ffa1c4b2ff7f0ec

SHA256
f28d9a688dc2c525f27b1b2bc742b87eca0992a680914ca8cfe9e3237f4fa35d

SHA512
899ba52f470ea6f57c7de00db8a867f651f403ea122288b4e3d54bf2b60cea13937721fc55fb1fb25aae11e46d728b920702a436f4d6c4bba85e083c39d566d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
74KB

MD5
ce6c7b7664e4d731dca7e2500a17dad0

SHA1
52eacc99e4b150dd657db52d9ffa1c4b2ff7f0ec

SHA256
f28d9a688dc2c525f27b1b2bc742b87eca0992a680914ca8cfe9e3237f4fa35d

SHA512
899ba52f470ea6f57c7de00db8a867f651f403ea122288b4e3d54bf2b60cea13937721fc55fb1fb25aae11e46d728b920702a436f4d6c4bba85e083c39d566d1

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
74KB

MD5
ce6c7b7664e4d731dca7e2500a17dad0

SHA1
52eacc99e4b150dd657db52d9ffa1c4b2ff7f0ec

SHA256
f28d9a688dc2c525f27b1b2bc742b87eca0992a680914ca8cfe9e3237f4fa35d

SHA512
899ba52f470ea6f57c7de00db8a867f651f403ea122288b4e3d54bf2b60cea13937721fc55fb1fb25aae11e46d728b920702a436f4d6c4bba85e083c39d566d1

Download Submit
memory/1524-71-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/1524-81-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/1524-73-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2060-56-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/2060-68-0x0000000002480000-0x0000000002490000-memory.dmp

Filesize
64KB

Download
memory/2060-69-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/2060-54-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/2060-57-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2060-80-0x0000000002480000-0x0000000002490000-memory.dmp

Filesize
64KB

Download
memory/2060-55-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download