f482b02e3fac9cdeae74445b2916a95151c6a569575d8798dc184663cbda347d

Analysis

max time kernel
141s
max time network
146s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
17/07/2023, 16:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

950cb2c3662f46_JC.exe
Size

42KB
MD5

950cb2c3662f464562f2c94550eb2035
SHA1

8a31e9135675b8d6de0ba1a442d34cc412322c39
SHA256

f482b02e3fac9cdeae74445b2916a95151c6a569575d8798dc184663cbda347d
SHA512

a2913040beabb2ee556ff78a09266ed6734ea8dcf1a588b4153fe800ca5cbd7c900c225bcc565f3888b7256693d2dca17e9a8fe37aa0fefcaef5af8fd1f2ee99
SSDEEP

768:qUmnjFom/kLyMro2GtOOtEvwDpjeMLam5aFr7YOzzOM+O90NWetA:qUmnpomddpMOtEvwDpjjaYaFAvCuW3

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2412	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2144	950cb2c3662f46_JC.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2144-54-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral1/memory/2144-68-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral1/memory/2412-71-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral1/files/0x00080000000120e6-70.dat	upx
behavioral1/files/0x00080000000120e6-65.dat	upx
behavioral1/files/0x00080000000120e6-80.dat	upx
behavioral1/memory/2412-81-0x0000000000500000-0x000000000050F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 2412	2144	950cb2c3662f46_JC.exe	28
PID 2144 wrote to memory of 2412	2144	950cb2c3662f46_JC.exe	28
PID 2144 wrote to memory of 2412	2144	950cb2c3662f46_JC.exe	28
PID 2144 wrote to memory of 2412	2144	950cb2c3662f46_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\950cb2c3662f46_JC.exe
"C:\Users\Admin\AppData\Local\Temp\950cb2c3662f46_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2412

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
43KB

MD5
1fdc967e9653b9bc6cc00ff6151e445e

SHA1
b13faf8ebd31437392ed2e14125774d5a97fadc6

SHA256
63b17cb778b17219d4468ac50bcd27e824de66e39e827dae2ed1e1ec814df728

SHA512
720a0dffd0d411b1735fcf410e944acbc7fa4a24c17f3f97c619dfc4b3eab720542d04321092fea3171f5b5b082f27628bcfa9f07b4a36941df438f6a72ce808

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
43KB

MD5
1fdc967e9653b9bc6cc00ff6151e445e

SHA1
b13faf8ebd31437392ed2e14125774d5a97fadc6

SHA256
63b17cb778b17219d4468ac50bcd27e824de66e39e827dae2ed1e1ec814df728

SHA512
720a0dffd0d411b1735fcf410e944acbc7fa4a24c17f3f97c619dfc4b3eab720542d04321092fea3171f5b5b082f27628bcfa9f07b4a36941df438f6a72ce808

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
43KB

MD5
1fdc967e9653b9bc6cc00ff6151e445e

SHA1
b13faf8ebd31437392ed2e14125774d5a97fadc6

SHA256
63b17cb778b17219d4468ac50bcd27e824de66e39e827dae2ed1e1ec814df728

SHA512
720a0dffd0d411b1735fcf410e944acbc7fa4a24c17f3f97c619dfc4b3eab720542d04321092fea3171f5b5b082f27628bcfa9f07b4a36941df438f6a72ce808

Download Submit
memory/2144-57-0x00000000001E0000-0x00000000001E6000-memory.dmp

Filesize
24KB

Download
memory/2144-56-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2144-55-0x00000000001E0000-0x00000000001E6000-memory.dmp

Filesize
24KB

Download
memory/2144-69-0x0000000001FE0000-0x0000000001FEF000-memory.dmp

Filesize
60KB

Download
memory/2144-68-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2144-54-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2412-71-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2412-74-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2412-73-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2412-81-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download