ac7cb9772deb5daefaf2efe09988e696b8696e67e0ae0e8d19f2e829f06fb0b5

Analysis

max time kernel
151s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
23/07/2023, 18:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NA_NA_24cb4d574a24e2exeexe_JC.exe
Size

51KB
MD5

24cb4d574a24e217a8553b6c1f16be0c
SHA1

8f4749f7ab5217d27d002932d7a966247316f81c
SHA256

ac7cb9772deb5daefaf2efe09988e696b8696e67e0ae0e8d19f2e829f06fb0b5
SHA512

39dd71b2b379abf9709c40994701f7cb9d16fc45fec2eb0817a1f57edf7b4600655cfcc07f6ae4884aacc56b2fed4867f1e97e43a373501b279ef88f11e0dd14
SSDEEP

768:zQz7yVEhs9+syJP6ntOOtEvwDpjFeV0kk26:zj+soPSMOtEvwDpj4yZ

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
480	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
492	NA_NA_24cb4d574a24e2exeexe_JC.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/492-53-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x0007000000012107-64.dat	upx
behavioral1/files/0x0007000000012107-67.dat	upx
behavioral1/memory/492-68-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x0007000000012107-77.dat	upx
behavioral1/memory/480-78-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 492 wrote to memory of 480	492	NA_NA_24cb4d574a24e2exeexe_JC.exe	29
PID 492 wrote to memory of 480	492	NA_NA_24cb4d574a24e2exeexe_JC.exe	29
PID 492 wrote to memory of 480	492	NA_NA_24cb4d574a24e2exeexe_JC.exe	29
PID 492 wrote to memory of 480	492	NA_NA_24cb4d574a24e2exeexe_JC.exe	29

C:\Users\Admin\AppData\Local\Temp\NA_NA_24cb4d574a24e2exeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NA_NA_24cb4d574a24e2exeexe_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:492
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
51KB

MD5
4047f8732b316b856df679854732b973

SHA1
4decfbbb4219294abaee1a427c5f15148d13908f

SHA256
6b8ef5f79c57eb8db4b5b3d0a9f97765dcaec0a0933b859b4bcc28d11c0ef0e3

SHA512
fd4dde61bc50c9b490c332d49d5d9827729d285b8c2819388f2f0ada13c4dd58599f38617711b66bb990955d83c6edbc20ace69813b2ee363587589821976815

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
51KB

MD5
4047f8732b316b856df679854732b973

SHA1
4decfbbb4219294abaee1a427c5f15148d13908f

SHA256
6b8ef5f79c57eb8db4b5b3d0a9f97765dcaec0a0933b859b4bcc28d11c0ef0e3

SHA512
fd4dde61bc50c9b490c332d49d5d9827729d285b8c2819388f2f0ada13c4dd58599f38617711b66bb990955d83c6edbc20ace69813b2ee363587589821976815

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
51KB

MD5
4047f8732b316b856df679854732b973

SHA1
4decfbbb4219294abaee1a427c5f15148d13908f

SHA256
6b8ef5f79c57eb8db4b5b3d0a9f97765dcaec0a0933b859b4bcc28d11c0ef0e3

SHA512
fd4dde61bc50c9b490c332d49d5d9827729d285b8c2819388f2f0ada13c4dd58599f38617711b66bb990955d83c6edbc20ace69813b2ee363587589821976815

Download Submit
memory/480-70-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/480-71-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/480-78-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/492-53-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/492-54-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/492-55-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/492-56-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/492-68-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download