cd0d26e20d879311e56ba7f57683e25eca1983eba16c58abb2b591373ee723c5

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
18/07/2023, 14:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bba48bf134953b_JC.exe
Size

78KB
MD5

bba48bf134953bb4279d96eae4e30a77
SHA1

e6dbe66a2e7972857a663b4d5298e98a44206813
SHA256

cd0d26e20d879311e56ba7f57683e25eca1983eba16c58abb2b591373ee723c5
SHA512

46a4b02c8e9a8c6553169e078093a6ae3f97a1c6073c381cfda664cb7d89e7d1eef23efe66e8f0d99619898c13d2010a180ca3050713ac0d03fe317630c88ed6
SSDEEP

1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsalDSnU3:1nK6a+qdOOtEvwDpjc

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2324	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2564	bba48bf134953b_JC.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2564-54-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/memory/2564-69-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/memory/2324-72-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/files/0x00070000000120e6-70.dat	upx
behavioral1/files/0x00070000000120e6-65.dat	upx
behavioral1/files/0x00070000000120e6-80.dat	upx
behavioral1/memory/2324-82-0x0000000000500000-0x000000000050F311-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 2324	2564	bba48bf134953b_JC.exe	28
PID 2564 wrote to memory of 2324	2564	bba48bf134953b_JC.exe	28
PID 2564 wrote to memory of 2324	2564	bba48bf134953b_JC.exe	28
PID 2564 wrote to memory of 2324	2564	bba48bf134953b_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\bba48bf134953b_JC.exe
"C:\Users\Admin\AppData\Local\Temp\bba48bf134953b_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2324

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
78KB

MD5
4de4e2e5b7da7306336429e860b2b404

SHA1
a5943b8d5cc664c1f466b140519186b43c57cc21

SHA256
5a44166319be0571ff8eb6892fb0d6bc5d078e40af203489a23805a8397c56b4

SHA512
ba76c054040ea0d02e28e61c910f9be0a3354f4c1d2ce441e4a5abac6e1a9b2f35b0c0852884eb611cdc4be351309dcbd34c8edae1d828c6e64f065c6410769a

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
78KB

MD5
4de4e2e5b7da7306336429e860b2b404

SHA1
a5943b8d5cc664c1f466b140519186b43c57cc21

SHA256
5a44166319be0571ff8eb6892fb0d6bc5d078e40af203489a23805a8397c56b4

SHA512
ba76c054040ea0d02e28e61c910f9be0a3354f4c1d2ce441e4a5abac6e1a9b2f35b0c0852884eb611cdc4be351309dcbd34c8edae1d828c6e64f065c6410769a

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
78KB

MD5
4de4e2e5b7da7306336429e860b2b404

SHA1
a5943b8d5cc664c1f466b140519186b43c57cc21

SHA256
5a44166319be0571ff8eb6892fb0d6bc5d078e40af203489a23805a8397c56b4

SHA512
ba76c054040ea0d02e28e61c910f9be0a3354f4c1d2ce441e4a5abac6e1a9b2f35b0c0852884eb611cdc4be351309dcbd34c8edae1d828c6e64f065c6410769a

Download Submit
memory/2324-73-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2324-72-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/2324-74-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2324-82-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/2564-69-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/2564-57-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2564-68-0x0000000001D70000-0x0000000001D80000-memory.dmp

Filesize
64KB

Download
memory/2564-56-0x0000000000200000-0x0000000000206000-memory.dmp

Filesize
24KB

Download
memory/2564-54-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/2564-55-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2564-81-0x0000000001D70000-0x0000000001D80000-memory.dmp

Filesize
64KB

Download