69fad9b5a2b1f4d84725317d23ff97d044f20db1bfc12a0458eada5858b685f7

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 04:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dec7f2f23dab0e77321bd130fd8b450b.exe
Size

68KB
MD5

dec7f2f23dab0e77321bd130fd8b450b
SHA1

f79890f59fbc65b9c4ef46edaafe9beab8738b1c
SHA256

69fad9b5a2b1f4d84725317d23ff97d044f20db1bfc12a0458eada5858b685f7
SHA512

f3e14974a1a794d4da877e463e393ad3c5ea30f4fabc07f56e32f834e8237a15bbfe797c9a86bf233c1d84fd476c2ba997be74ba9c71f8b2ae15488dcf8cb47b
SSDEEP

1536:Dk/xY0sllyGQMOtEvwDpjwycDtKkQZQRKb61vSbgZ3QzNKUHX0:DW60sllyWOtEvwDpjwF852

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2100	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1660	dec7f2f23dab0e77321bd130fd8b450b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 2100	1660	dec7f2f23dab0e77321bd130fd8b450b.exe	28
PID 1660 wrote to memory of 2100	1660	dec7f2f23dab0e77321bd130fd8b450b.exe	28
PID 1660 wrote to memory of 2100	1660	dec7f2f23dab0e77321bd130fd8b450b.exe	28
PID 1660 wrote to memory of 2100	1660	dec7f2f23dab0e77321bd130fd8b450b.exe	28

C:\Users\Admin\AppData\Local\Temp\dec7f2f23dab0e77321bd130fd8b450b.exe
"C:\Users\Admin\AppData\Local\Temp\dec7f2f23dab0e77321bd130fd8b450b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
69KB

MD5
607a7db818344ff630ed3ad569d5d8c7

SHA1
109bdb90fac7e03669b2b3dee4e05b642c3c12aa

SHA256
02aef4033c7e987c05a1c5c12448401479ab4ba62f0e6c190049c13a9cf61603

SHA512
2f697d809b660e0917c0eddc59674bc739b91fbdac4967f50be3183f5f81934a709a26ab3036ad28bb51ef351aa1449f5802307bd1630d58caa3fe8ddc93a36e

Download Submit
memory/1660-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/1660-1-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download
memory/1660-2-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/1660-4-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download
memory/1660-13-0x00000000006F0000-0x00000000006FB000-memory.dmp

Filesize
44KB

Download
memory/1660-15-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2100-17-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2100-19-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2100-20-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download