Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    12/02/2024, 04:23

General

  • Target

    e47da284965bc2e84bb53066ec5a1055.exe

  • Size

    51KB

  • MD5

    e47da284965bc2e84bb53066ec5a1055

  • SHA1

    cef68bf8932e4210cfef5048e47dcd99c333045f

  • SHA256

    fc0ff8110c8c405a7673dcb126a5ec639e7f50d082d86a3787d60becf232f3ff

  • SHA512

    cabfe3d99601fc67d22574176532345d6f02bca67a4c23d758964da00fa5f4775327ac925edb48c91d1aa5274e9baede66100134fc26ef054c2277664c4c7dd2

  • SSDEEP

    768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vaToguMy83:X6QFElP6n+gJBMOtEvwDpjBtEJNMd3

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e47da284965bc2e84bb53066ec5a1055.exe
    "C:\Users\Admin\AppData\Local\Temp\e47da284965bc2e84bb53066ec5a1055.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2200
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2460

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    51KB

    MD5

    342d9d5bd7d7cf1def6e4abf578d8a91

    SHA1

    6b7f473e091654a9705d5e489b03bfebc53a91a6

    SHA256

    2f8900117f70a78d38825103f918b65cbb25e50ef09121b208548e93d891bd77

    SHA512

    d0d76e6334f7b5c8140b1d3ef5a6300e798085781469e84e5947c1e0e1b3a344a987ac34276361df41e1cc9ba32688e95a1efbcd4e8cef6a5539801658228b4a

  • memory/2200-0-0x0000000000230000-0x0000000000236000-memory.dmp

    Filesize

    24KB

  • memory/2200-1-0x00000000002F0000-0x00000000002F6000-memory.dmp

    Filesize

    24KB

  • memory/2200-3-0x0000000000230000-0x0000000000236000-memory.dmp

    Filesize

    24KB

  • memory/2460-15-0x0000000000270000-0x0000000000276000-memory.dmp

    Filesize

    24KB

  • memory/2460-17-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB