51d921897f5aa6e6881538b65faa242de61bad6849faccd1ff52f2b5eb3f2507

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
17/07/2023, 18:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a3bf939aef9de3_JC.exe
Size

31KB
MD5

a3bf939aef9de3acbd851d03b464bff5
SHA1

32c0dd5cc60a7e52a8d9d315149fa14f433eb904
SHA256

51d921897f5aa6e6881538b65faa242de61bad6849faccd1ff52f2b5eb3f2507
SHA512

09a4402f91b09f63bd06adf5aba1efa523b88efa39e59ff10cb0fdaba13c1eafd174b15dac8fed2d9bcffbf1f8a40386e81663f582a8a57073ebda7294971440
SSDEEP

384:bAvMaNGh4z7CG3POOvbRSLoF/F0QU5XYFnufc/zzoiEcIuqFwfa:bAvJCYOOvbRPDEgXNZS

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3024	demka.exe

Loads dropped DLL 1 IoCs

pid	Process
2440	a3bf939aef9de3_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2440	a3bf939aef9de3_JC.exe
3024	demka.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 3024	2440	a3bf939aef9de3_JC.exe	28
PID 2440 wrote to memory of 3024	2440	a3bf939aef9de3_JC.exe	28
PID 2440 wrote to memory of 3024	2440	a3bf939aef9de3_JC.exe	28
PID 2440 wrote to memory of 3024	2440	a3bf939aef9de3_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\a3bf939aef9de3_JC.exe
"C:\Users\Admin\AppData\Local\Temp\a3bf939aef9de3_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Users\Admin\AppData\Local\Temp\demka.exe
  "C:\Users\Admin\AppData\Local\Temp\demka.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3024

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
31KB

MD5
28aefa962b6be25221c0c845836aeb90

SHA1
f9c4fda31b323dc9e24cb22558ab30eb719cd6f3

SHA256
306abf9965ff559e07eb1b82650bf19c2f21d5c59e9512e96a35ac934f19c294

SHA512
6e61ae6320923d0c58de4abb4ffd867caf6a2185cc2d071cd9a604f66e79da29eb9f31ebea39191d0d97a284a366429a4691bf31bd6ff1d9d0808973359dcd41

Download Submit
C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
31KB

MD5
28aefa962b6be25221c0c845836aeb90

SHA1
f9c4fda31b323dc9e24cb22558ab30eb719cd6f3

SHA256
306abf9965ff559e07eb1b82650bf19c2f21d5c59e9512e96a35ac934f19c294

SHA512
6e61ae6320923d0c58de4abb4ffd867caf6a2185cc2d071cd9a604f66e79da29eb9f31ebea39191d0d97a284a366429a4691bf31bd6ff1d9d0808973359dcd41

Download Submit
\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
31KB

MD5
28aefa962b6be25221c0c845836aeb90

SHA1
f9c4fda31b323dc9e24cb22558ab30eb719cd6f3

SHA256
306abf9965ff559e07eb1b82650bf19c2f21d5c59e9512e96a35ac934f19c294

SHA512
6e61ae6320923d0c58de4abb4ffd867caf6a2185cc2d071cd9a604f66e79da29eb9f31ebea39191d0d97a284a366429a4691bf31bd6ff1d9d0808973359dcd41

Download Submit
memory/2440-54-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/2440-56-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/2440-55-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3024-71-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download