813dac69f9fd245fb1f8d4cd315aff8a0c1d0e38de36d955317ae37e31228b8d

Analysis

max time kernel
149s
max time network
155s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
21-02-2024 02:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e206bbe2a12cc7d2213b169fbdc39ef.exe
Size

49KB
MD5

3e206bbe2a12cc7d2213b169fbdc39ef
SHA1

dd0cfe7f3dd8025f7ba4ac73a0be94a055ac4441
SHA256

813dac69f9fd245fb1f8d4cd315aff8a0c1d0e38de36d955317ae37e31228b8d
SHA512

a2e0a37d3ed74454deaae2e62e806efb1587efec536faeebc42ba49aa85ac5a92af657027f8823cc8993e8d98134eed04885b8bf24e33f3923abbf733de27686
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vxd:X6QFElP6n+gJBMOtEvwDpjBtExd

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2276	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1724	3e206bbe2a12cc7d2213b169fbdc39ef.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2276	1724	3e206bbe2a12cc7d2213b169fbdc39ef.exe	28
PID 1724 wrote to memory of 2276	1724	3e206bbe2a12cc7d2213b169fbdc39ef.exe	28
PID 1724 wrote to memory of 2276	1724	3e206bbe2a12cc7d2213b169fbdc39ef.exe	28
PID 1724 wrote to memory of 2276	1724	3e206bbe2a12cc7d2213b169fbdc39ef.exe	28

C:\Users\Admin\AppData\Local\Temp\3e206bbe2a12cc7d2213b169fbdc39ef.exe
"C:\Users\Admin\AppData\Local\Temp\3e206bbe2a12cc7d2213b169fbdc39ef.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
50KB

MD5
0063719ade06ff987d4d80dbb29268d9

SHA1
ca9e5b9420de6c7b26e348503f5ff59a6feb2bb0

SHA256
ab9a6edcc26696685c8a0f12441e78a21d12b6226153634e304eb889e69e9017

SHA512
dee604ddf043883ac17949c3baaf166df5c57604dd8ce030349d80544373e274d86c6dc99eb0f2d0bdc6e601a21492cd4ef47cb8604dd28f9a136852f4b595b3

Download Submit
memory/1724-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1724-1-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/1724-2-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2276-15-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download