a6cec81e625dac4847ed7a37ad2509b0cff0a5307f9733cf726fcc14c5281467

Analysis

max time kernel
152s
max time network
159s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/02/2024, 03:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d8efc3a4092fc2f5e36938dff8fabc99.exe
Size

34KB
MD5

d8efc3a4092fc2f5e36938dff8fabc99
SHA1

194f99ddc2d39401e77d66c4efbead29178651a1
SHA256

a6cec81e625dac4847ed7a37ad2509b0cff0a5307f9733cf726fcc14c5281467
SHA512

683ce64560669223f5f54ee313de4de5d7be8df10587e940b01ba3ebf8b770445dbc3bae600cba38573766afe636c035296bef31b9eb9952d43f366af8bd23ea
SSDEEP

768:qUmnjFom/kLyMro2GtOOtEvwDpjeMLam5ax6:qUmnpomddpMOtEvwDpjjaYa4

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1956	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2148	d8efc3a4092fc2f5e36938dff8fabc99.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2148-0-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral1/files/0x000d000000014b3c-11.dat	upx
behavioral1/memory/2148-15-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral1/memory/1956-17-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral1/memory/1956-27-0x0000000000500000-0x000000000050F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 1956	2148	d8efc3a4092fc2f5e36938dff8fabc99.exe	28
PID 2148 wrote to memory of 1956	2148	d8efc3a4092fc2f5e36938dff8fabc99.exe	28
PID 2148 wrote to memory of 1956	2148	d8efc3a4092fc2f5e36938dff8fabc99.exe	28
PID 2148 wrote to memory of 1956	2148	d8efc3a4092fc2f5e36938dff8fabc99.exe	28

C:\Users\Admin\AppData\Local\Temp\d8efc3a4092fc2f5e36938dff8fabc99.exe
"C:\Users\Admin\AppData\Local\Temp\d8efc3a4092fc2f5e36938dff8fabc99.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
34KB

MD5
bb91d1538d0c9936f73a8b7a6f548290

SHA1
6ba5b14cb7f36ca7b27b7d8cf980fd99af4dd57e

SHA256
f57ca224788a428c17b0c6235937e924ac8d21ead3ff5e6cba88c5d15fcd0efd

SHA512
f6b1885c39ac07fe4771a5610178e23c349226b98a54e17371857f74ce02596e0d058fdd18e7c750e365706296ebd4111e00d265bc9433c658e664304e012387

Download Submit
memory/1956-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1956-19-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/1956-21-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1956-27-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2148-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2148-1-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2148-2-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2148-9-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2148-15-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2148-14-0x0000000001FF0000-0x0000000001FFF000-memory.dmp

Filesize
60KB

Download