eb1a1abc83d1de3f40473a230e08a36a94b12d50f96c159d844c94c1b2fe1df3

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
23-07-2023 17:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NA_NA_1c34d6ee7dc102exeexe_JC.exe
Size

39KB
MD5

1c34d6ee7dc10242ed61914489d83873
SHA1

cf203098b20d70de2b2f3ea1b691b306b97397e0
SHA256

eb1a1abc83d1de3f40473a230e08a36a94b12d50f96c159d844c94c1b2fe1df3
SHA512

bbe70f1723a79955c10616e5f8ea39e57df70c3b9e447570d0739d27f3373512713adabc5716a10bae4cbc5db6ac4c4a8585cfeea6bd7eb6184d32a3e34e97d2
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpjeJQLI3s1BHRVrCd:V6QFElP6n+gMQMOtEvwDpjeJQysr2

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2532	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2592	NA_NA_1c34d6ee7dc102exeexe_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 2532	2592	NA_NA_1c34d6ee7dc102exeexe_JC.exe	28
PID 2592 wrote to memory of 2532	2592	NA_NA_1c34d6ee7dc102exeexe_JC.exe	28
PID 2592 wrote to memory of 2532	2592	NA_NA_1c34d6ee7dc102exeexe_JC.exe	28
PID 2592 wrote to memory of 2532	2592	NA_NA_1c34d6ee7dc102exeexe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NA_NA_1c34d6ee7dc102exeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NA_NA_1c34d6ee7dc102exeexe_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
39KB

MD5
3ff95f68aa2a79d3e4052f15f3159a31

SHA1
a28bdbedf7ed839c5d257db0d956428f39fd5a88

SHA256
454d41ed2b2f61e3df6dc77cabad83dd72589f7d921e4affbb8f8693c2178065

SHA512
bd0dce572158264248e6a833179f36e1f7ca89cf36b49137ae9ac855856252b3b0f99e20ef5be713979e6361a57731cf158c24b9fa8c9add6a72f8610231702c

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
39KB

MD5
3ff95f68aa2a79d3e4052f15f3159a31

SHA1
a28bdbedf7ed839c5d257db0d956428f39fd5a88

SHA256
454d41ed2b2f61e3df6dc77cabad83dd72589f7d921e4affbb8f8693c2178065

SHA512
bd0dce572158264248e6a833179f36e1f7ca89cf36b49137ae9ac855856252b3b0f99e20ef5be713979e6361a57731cf158c24b9fa8c9add6a72f8610231702c

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
39KB

MD5
3ff95f68aa2a79d3e4052f15f3159a31

SHA1
a28bdbedf7ed839c5d257db0d956428f39fd5a88

SHA256
454d41ed2b2f61e3df6dc77cabad83dd72589f7d921e4affbb8f8693c2178065

SHA512
bd0dce572158264248e6a833179f36e1f7ca89cf36b49137ae9ac855856252b3b0f99e20ef5be713979e6361a57731cf158c24b9fa8c9add6a72f8610231702c

Download Submit
memory/2532-70-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2532-69-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2592-54-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2592-56-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2592-55-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download