cd9cde9b750627f18cd128be1b2f5fe1e633ded578971e7a782dd02fe052883d

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
17/07/2023, 18:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3411500e67f35_JC.exe
Size

85KB
MD5

a3411500e67f35ac79b4e01335da1700
SHA1

a961e0d7b960f8b63d5d8e5bb30ac97aa3ddb524
SHA256

cd9cde9b750627f18cd128be1b2f5fe1e633ded578971e7a782dd02fe052883d
SHA512

e7083128d7c7a026ed16b0450581550d07fb3c6faf5e4bfc3ca8b10b0db87fc8d3102d1a460602ca2a7592494ae9d28ed41804c31f39a4ff8e70a5e955e202df
SSDEEP

1536:zj+soPSMOtEvwDpj4ktBl01hJl8QAPM8Ho6cRDjix:zCsanOtEvwDpjr

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
544	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2912	a3411500e67f35_JC.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2912-53-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x0008000000012022-67.dat	upx
behavioral1/memory/2912-69-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x0008000000012022-64.dat	upx
behavioral1/memory/544-71-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x0008000000012022-79.dat	upx
behavioral1/memory/544-80-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 544	2912	a3411500e67f35_JC.exe	28
PID 2912 wrote to memory of 544	2912	a3411500e67f35_JC.exe	28
PID 2912 wrote to memory of 544	2912	a3411500e67f35_JC.exe	28
PID 2912 wrote to memory of 544	2912	a3411500e67f35_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\a3411500e67f35_JC.exe
"C:\Users\Admin\AppData\Local\Temp\a3411500e67f35_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
86KB

MD5
23992eebcbe5b2c8083c54e0b661a422

SHA1
f0b43c3d28136174f9711a0293cea9f1baabbb9f

SHA256
e586ef10848997398147c96209b673054d3afc4d3afe234302667f4b81076216

SHA512
425bb1f562ed3ef8c7bfe9a5c0853fc2f0dfe38d4005ae0e92dbccca51fc116002e139cdd4441c8733adf0b63b98215978506709c15399ad2607b1e6b37a6ec8

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
86KB

MD5
23992eebcbe5b2c8083c54e0b661a422

SHA1
f0b43c3d28136174f9711a0293cea9f1baabbb9f

SHA256
e586ef10848997398147c96209b673054d3afc4d3afe234302667f4b81076216

SHA512
425bb1f562ed3ef8c7bfe9a5c0853fc2f0dfe38d4005ae0e92dbccca51fc116002e139cdd4441c8733adf0b63b98215978506709c15399ad2607b1e6b37a6ec8

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
86KB

MD5
23992eebcbe5b2c8083c54e0b661a422

SHA1
f0b43c3d28136174f9711a0293cea9f1baabbb9f

SHA256
e586ef10848997398147c96209b673054d3afc4d3afe234302667f4b81076216

SHA512
425bb1f562ed3ef8c7bfe9a5c0853fc2f0dfe38d4005ae0e92dbccca51fc116002e139cdd4441c8733adf0b63b98215978506709c15399ad2607b1e6b37a6ec8

Download Submit
memory/544-80-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/544-73-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/544-72-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/544-71-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2912-57-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2912-68-0x0000000002800000-0x0000000002810000-memory.dmp

Filesize
64KB

Download
memory/2912-69-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2912-53-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2912-55-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/2912-54-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download