ec35f4328039b1d75a207e7d59d07629ab6efe323a8ff5ed559aa412f0ee77c1

Analysis

max time kernel
133s
max time network
143s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
23-07-2023 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NA_NA_21767dbf228f10exeexe_JC.exe
Size

55KB
MD5

21767dbf228f10a93631d065da1ad4f3
SHA1

d56fb70f61780f05b1284f9059581e7c5c2a521d
SHA256

ec35f4328039b1d75a207e7d59d07629ab6efe323a8ff5ed559aa412f0ee77c1
SHA512

91f370eb76ac9cee96358e2d1e5945a85ae88953cec7bc7f25cf63960f0948f88f248ea6e53a6640b460bdfd72ba41885580995f7d83e9b530673aceaf64e217
SSDEEP

768:zQz7yVEhs9+syJP6ntOOtEvwDpjFelaB7yBEY9S2U:zj+soPSMOtEvwDpj4kpmw

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2988	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1932	NA_NA_21767dbf228f10exeexe_JC.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1932-54-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1932-68-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2988-70-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x0008000000012029-69.dat	upx
behavioral1/files/0x0008000000012029-65.dat	upx
behavioral1/files/0x0008000000012029-79.dat	upx
behavioral1/memory/2988-80-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2988	1932	NA_NA_21767dbf228f10exeexe_JC.exe	28
PID 1932 wrote to memory of 2988	1932	NA_NA_21767dbf228f10exeexe_JC.exe	28
PID 1932 wrote to memory of 2988	1932	NA_NA_21767dbf228f10exeexe_JC.exe	28
PID 1932 wrote to memory of 2988	1932	NA_NA_21767dbf228f10exeexe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NA_NA_21767dbf228f10exeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NA_NA_21767dbf228f10exeexe_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
55KB

MD5
1ade509b47f8aa32e955fbdfb0ea8a1a

SHA1
ec4baa0b74d943cb7043ec6c506ce998e3126d7a

SHA256
2488b7b1a22518554c983faa0fbf5d0afd265eeb806f7b841d652bcf68173129

SHA512
b0584d42777a2f650b9b35cc18477bbea4d20141f1d113068f50d6a2a6fb092fcfd98e69499a538442ccc334c4665cacd588c927565563be95a0a2725f321136

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
55KB

MD5
1ade509b47f8aa32e955fbdfb0ea8a1a

SHA1
ec4baa0b74d943cb7043ec6c506ce998e3126d7a

SHA256
2488b7b1a22518554c983faa0fbf5d0afd265eeb806f7b841d652bcf68173129

SHA512
b0584d42777a2f650b9b35cc18477bbea4d20141f1d113068f50d6a2a6fb092fcfd98e69499a538442ccc334c4665cacd588c927565563be95a0a2725f321136

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
55KB

MD5
1ade509b47f8aa32e955fbdfb0ea8a1a

SHA1
ec4baa0b74d943cb7043ec6c506ce998e3126d7a

SHA256
2488b7b1a22518554c983faa0fbf5d0afd265eeb806f7b841d652bcf68173129

SHA512
b0584d42777a2f650b9b35cc18477bbea4d20141f1d113068f50d6a2a6fb092fcfd98e69499a538442ccc334c4665cacd588c927565563be95a0a2725f321136

Download Submit
memory/1932-54-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1932-55-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1932-56-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/1932-57-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1932-68-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2988-70-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2988-73-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2988-72-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/2988-80-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download