0d0635eb86203fccd53402efdd63fb0737a152db6870ed9bf20da1f161571549

Analysis

max time kernel
150s
max time network
141s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19-07-2023 12:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e27c57e463cee5exe_JC.exe
Size

58KB
MD5

e27c57e463cee569b7b1ae4b07aa8b63
SHA1

afb328a15d6bfc6fe0576918da1d44ff0f367788
SHA256

0d0635eb86203fccd53402efdd63fb0737a152db6870ed9bf20da1f161571549
SHA512

fa31d8779bdcd9f41986c4034816eed172ca97c8093dbc277f3b9dfc165d5a2ac100feb6741b55b789916f7ee0cdd7bab79e87e02d9098dfc701e0fea953e903
SSDEEP

1536:79mqyNhQMOtEvwDpjBPY7xv3gy7ux1SkfnG:RlqbOtEvwDpjBgh

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2424	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1876	e27c57e463cee5exe_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2424	1876	e27c57e463cee5exe_JC.exe	28
PID 1876 wrote to memory of 2424	1876	e27c57e463cee5exe_JC.exe	28
PID 1876 wrote to memory of 2424	1876	e27c57e463cee5exe_JC.exe	28
PID 1876 wrote to memory of 2424	1876	e27c57e463cee5exe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\e27c57e463cee5exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\e27c57e463cee5exe_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2424

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
58KB

MD5
7570ca7915e379bebf327aeafe017752

SHA1
359cad85b2148590a447c112a8eb108d0f3a65fd

SHA256
0858a58e0277fa28f79ce772e6f85b18ba2d71c70b7a89e11dfc5592faa9567a

SHA512
7475858f4b71bfb7459c9e0b5a486045eb92ed9d132947729623301af979d78df6881106d37bee93a0752cd0bf0549c23dceffe13ad0b2dfdc5aa78bd170c3a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
58KB

MD5
7570ca7915e379bebf327aeafe017752

SHA1
359cad85b2148590a447c112a8eb108d0f3a65fd

SHA256
0858a58e0277fa28f79ce772e6f85b18ba2d71c70b7a89e11dfc5592faa9567a

SHA512
7475858f4b71bfb7459c9e0b5a486045eb92ed9d132947729623301af979d78df6881106d37bee93a0752cd0bf0549c23dceffe13ad0b2dfdc5aa78bd170c3a2

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
58KB

MD5
7570ca7915e379bebf327aeafe017752

SHA1
359cad85b2148590a447c112a8eb108d0f3a65fd

SHA256
0858a58e0277fa28f79ce772e6f85b18ba2d71c70b7a89e11dfc5592faa9567a

SHA512
7475858f4b71bfb7459c9e0b5a486045eb92ed9d132947729623301af979d78df6881106d37bee93a0752cd0bf0549c23dceffe13ad0b2dfdc5aa78bd170c3a2

Download Submit
memory/1876-54-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1876-55-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download
memory/1876-57-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/1876-56-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download
memory/1876-69-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2424-70-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2424-73-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2424-72-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2424-80-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download