5a01ed2b13b844100d2a12f9d55bfc689eafe16ec10ab9a5c976ce8d4c4cbf1a

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19-07-2023 13:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e65bc157469e7eexe_JC.exe
Size

30KB
MD5

e65bc157469e7e3543eb42f4d3740e50
SHA1

e546536c1e4f487fa5bda2fd6865d8d92b86cda3
SHA256

5a01ed2b13b844100d2a12f9d55bfc689eafe16ec10ab9a5c976ce8d4c4cbf1a
SHA512

3e5792fb4f858564c025601c69da9ca552a1272b9a21da7a5569c775bb54bc70d03d15d00e537ce7ab47a59ab8e0e9c94c8a9791dfda1de87723e7b30e413faa
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpjJ3W:V6QFElP6n+gMQMOtEvwDpjJG

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2476	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1908	e65bc157469e7eexe_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2476	1908	e65bc157469e7eexe_JC.exe	28
PID 1908 wrote to memory of 2476	1908	e65bc157469e7eexe_JC.exe	28
PID 1908 wrote to memory of 2476	1908	e65bc157469e7eexe_JC.exe	28
PID 1908 wrote to memory of 2476	1908	e65bc157469e7eexe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\e65bc157469e7eexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\e65bc157469e7eexe_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2476

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
30KB

MD5
1c2f3acf380818e19d07afb0f0e4049f

SHA1
400d7469047077edc776c76ce06d9706403edc11

SHA256
541a2df0289bf0b680b1193eba343e25cc823da366902e579bb20bdd522705eb

SHA512
7a9e50c86c759e6529cbe30c6c7a197b6e642a78c7df3119126e4e0ab08b79136c3ce9a47f7170f7c83259905ffc7adf77cef4f2fe60cd88f1adc97dbd79a02c

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
30KB

MD5
1c2f3acf380818e19d07afb0f0e4049f

SHA1
400d7469047077edc776c76ce06d9706403edc11

SHA256
541a2df0289bf0b680b1193eba343e25cc823da366902e579bb20bdd522705eb

SHA512
7a9e50c86c759e6529cbe30c6c7a197b6e642a78c7df3119126e4e0ab08b79136c3ce9a47f7170f7c83259905ffc7adf77cef4f2fe60cd88f1adc97dbd79a02c

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
30KB

MD5
1c2f3acf380818e19d07afb0f0e4049f

SHA1
400d7469047077edc776c76ce06d9706403edc11

SHA256
541a2df0289bf0b680b1193eba343e25cc823da366902e579bb20bdd522705eb

SHA512
7a9e50c86c759e6529cbe30c6c7a197b6e642a78c7df3119126e4e0ab08b79136c3ce9a47f7170f7c83259905ffc7adf77cef4f2fe60cd88f1adc97dbd79a02c

Download Submit
memory/1908-55-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/1908-54-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/1908-62-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/2476-70-0x00000000003F0000-0x00000000003F6000-memory.dmp

Filesize
24KB

Download
memory/2476-69-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download