e9339f7a4c29760d3f4604e8a69ce902d28d6a012bd04d2b24b22305bd255edd

Analysis

max time kernel
141s
max time network
146s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19-07-2023 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f604de29618c3aexe_JC.exe
Size

47KB
MD5

f604de29618c3a529fd4159a0af29ce4
SHA1

d933fd36ce8e9873c49baad1642e62a7baf667fd
SHA256

e9339f7a4c29760d3f4604e8a69ce902d28d6a012bd04d2b24b22305bd255edd
SHA512

7464ef651ecbd7e7a9eaa74be1aa6d6e225617cc2da7b82e65ba1c784b6f020fbb423157fde6600dca68596271b87c9a919ef93d7aba28381f6c6f38006dd59f
SSDEEP

768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05RKb6Fd3:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKby

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2240	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2084	f604de29618c3aexe_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2240	2084	f604de29618c3aexe_JC.exe	28
PID 2084 wrote to memory of 2240	2084	f604de29618c3aexe_JC.exe	28
PID 2084 wrote to memory of 2240	2084	f604de29618c3aexe_JC.exe	28
PID 2084 wrote to memory of 2240	2084	f604de29618c3aexe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\f604de29618c3aexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\f604de29618c3aexe_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2240

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
47KB

MD5
c141c6a9dfbb4c580e544836edc422d7

SHA1
a2edbd2239b3274682d381eb14c1f9c57a1bbbf3

SHA256
7242a052ed19ffec3f100836b1a9c84b2a3195f980a03ac90172e35fbc4cf495

SHA512
f65c9f5ae2a5a3c28230d01d4126dee4d2a6ab588bb563400999e94f4da75936220bb0b02bd65aed3749c112ada3dfadb1b0a102185a743bad5cd88130b57357

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
47KB

MD5
c141c6a9dfbb4c580e544836edc422d7

SHA1
a2edbd2239b3274682d381eb14c1f9c57a1bbbf3

SHA256
7242a052ed19ffec3f100836b1a9c84b2a3195f980a03ac90172e35fbc4cf495

SHA512
f65c9f5ae2a5a3c28230d01d4126dee4d2a6ab588bb563400999e94f4da75936220bb0b02bd65aed3749c112ada3dfadb1b0a102185a743bad5cd88130b57357

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
47KB

MD5
c141c6a9dfbb4c580e544836edc422d7

SHA1
a2edbd2239b3274682d381eb14c1f9c57a1bbbf3

SHA256
7242a052ed19ffec3f100836b1a9c84b2a3195f980a03ac90172e35fbc4cf495

SHA512
f65c9f5ae2a5a3c28230d01d4126dee4d2a6ab588bb563400999e94f4da75936220bb0b02bd65aed3749c112ada3dfadb1b0a102185a743bad5cd88130b57357

Download Submit
memory/2084-70-0x00000000005F0000-0x0000000000600000-memory.dmp

Filesize
64KB

Download
memory/2084-57-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2084-68-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2084-54-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2084-56-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2084-55-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2240-71-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2240-73-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/2240-74-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2240-81-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download