e019fc4655c07cc65a0e333eb7685a0b37a8a2513c93632c52473584681c0604

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
17-02-2024 19:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e019fc4655c07cc65a0e333eb7685a0b37a8a2513c93632c52473584681c0604.exe
Size

6.1MB
MD5

a5975a2be60dba4c3b4379748c8395df
SHA1

d7c3eadee9feb4fb419826a9e664f2bc2c68dcbc
SHA256

e019fc4655c07cc65a0e333eb7685a0b37a8a2513c93632c52473584681c0604
SHA512

2a7feec187aa119d1adfc8a6db467e955febe1324f3c0f46656c1804e21c0af1bc283db15ac172d05b9a2178c078ba62288fbb783a0b20c49f6d1b046843acc9
SSDEEP

196608:yD1qTulzVzGcsRIo6m1Yz2y3+0ZiBu2BbiIMQI0G/:Nu//9o6M42a+0ZmxLMQu

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

ak.exe

pid process

2836 ak.exe
Loads dropped DLL 3 IoCs

Processes:

e019fc4655c07cc65a0e333eb7685a0b37a8a2513c93632c52473584681c0604.exeak.exe

pid process

2380 e019fc4655c07cc65a0e333eb7685a0b37a8a2513c93632c52473584681c0604.exe
2616
2836 ak.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2836	ak.exe

pid	process
2380	e019fc4655c07cc65a0e333eb7685a0b37a8a2513c93632c52473584681c0604.exe
2616
2836	ak.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e019fc4655c07cc65a0e333eb7685a0b37a8a2513c93632c52473584681c0604.exe

description	pid	process	target process
PID 2380 wrote to memory of 2836	2380	e019fc4655c07cc65a0e333eb7685a0b37a8a2513c93632c52473584681c0604.exe	ak.exe
PID 2380 wrote to memory of 2836	2380	e019fc4655c07cc65a0e333eb7685a0b37a8a2513c93632c52473584681c0604.exe	ak.exe
PID 2380 wrote to memory of 2836	2380	e019fc4655c07cc65a0e333eb7685a0b37a8a2513c93632c52473584681c0604.exe	ak.exe
PID 2380 wrote to memory of 2836	2380	e019fc4655c07cc65a0e333eb7685a0b37a8a2513c93632c52473584681c0604.exe	ak.exe

C:\Users\Admin\AppData\Local\Temp\e019fc4655c07cc65a0e333eb7685a0b37a8a2513c93632c52473584681c0604.exe
"C:\Users\Admin\AppData\Local\Temp\e019fc4655c07cc65a0e333eb7685a0b37a8a2513c93632c52473584681c0604.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2380

C:\Users\Admin\AppData\Local\Temp\RarSFX0\ak.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\ak.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\python311.dll
Filesize
5.7MB

MD5
34baa8088b479361208b691a87aa5238

SHA1
0034f14fbcb1328dd5a65395f47c00c7ef72cbaf

SHA256
162e8557fbed5f39ae24983ee62b2d435b4796c937d9c1a34371888c7e43af00

SHA512
6900da9a20bcefea0c334f07c758fdce991753dd0f65cc5587800c544110343f9beed7bce8b534b8531db009f1824d3e454157d45a1a95e1dff2472572b6edff

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\ak.exe
Filesize
6.7MB

MD5
4139a1342b752e851e1bce6a09943d2d

SHA1
a8f7fe1eb58ff06786aa974a346af72d86715a27

SHA256
fc6bf4cac4681d5b782f87563e0234995cbcda6717dafd05280884f1bf000f96

SHA512
5c3810c46806ed82f334a5e209ad7220a634abdf089329f6001bec9fa58e9925c03f13808a9274d20e157564f910bc8b9119a226ec6c8b84a722bab63f53ad4d

Download Submit
memory/2836-38-0x000000013FB40000-0x0000000140206000-memory.dmp

Filesize
6.8MB

Download