f163e5ac7c5dc3b252dfcfcfea1bd85445d82241a18b88a3091c9fffef0f8c77

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c8a523d3eb5ffdd5dbb657fb92ac5a09.exe
Size 60KB
Sample240314-pxtprscc6y
SHA256 f163e5ac7c5dc3b252dfcfcfea1bd85445d82241a18b88a3091c9fffef0f8c77
MD5 c8a523d3eb5ffdd5dbb657fb92ac5a09
SHA1 3da989a9856bb854fd6ecd4ed6f7099dc10a4993
SHA512 bbac616267148e8d47e59977221c0d8b752fc6e6f1daf7c4f9649fc46e417d284b5959187111c17b640b656b33c177da25af7bb6ef49a79e7bf57c9cb19bb705
SSDEEP 1536:ip23W0G5S6Gi+xIlPH1zabXAHSIFNznU5Yz2axA:RlG5jgIlP1+0yQNo5Yz2au
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0009000000023212-5.dat	aspack_v212_v242

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\webcint.dll	c8a523d3eb5ffdd5dbb657fb92ac5a09.exe
File created	C:\Windows\SysWOW64\webcint.dll	c8a523d3eb5ffdd5dbb657fb92ac5a09.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\err	c8a523d3eb5ffdd5dbb657fb92ac5a09.exe
File created	C:\Program Files (x86)\Internet Explorer\wsock32.dll	c8a523d3eb5ffdd5dbb657fb92ac5a09.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\wsock32.dll	c8a523d3eb5ffdd5dbb657fb92ac5a09.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 3176	4892	c8a523d3eb5ffdd5dbb657fb92ac5a09.exe	85
PID 4892 wrote to memory of 3176	4892	c8a523d3eb5ffdd5dbb657fb92ac5a09.exe	85
PID 4892 wrote to memory of 3176	4892	c8a523d3eb5ffdd5dbb657fb92ac5a09.exe	85

C:\Users\Admin\AppData\Local\Temp\c8a523d3eb5ffdd5dbb657fb92ac5a09.exe
"C:\Users\Admin\AppData\Local\Temp\c8a523d3eb5ffdd5dbb657fb92ac5a09.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\c8a523d3eb5ffdd5dbb657fb92ac5a09.exe.bat
  2⤵
  PID:3176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

wsock32.dll

Path C:\Program Files (x86)\Internet Explorer\wsock32.dll
Size 49KB
SHA256 346ed8e67eed71ace9483aeb31cc05c8b39446a78b328abcd6a844bf0caa4bcb
MD5 4ec327ddcf0be93b1a7de3c3ccea611e
SHA1 20eaf197962c9b402358b80303a331870ee762e2
SHA512 30240ac971f637859b2959214c499d492f54a59e6138db3cfb7be8471a4eafc8837fd36d59a4763181d11653b4553354217185d61d589527d4e8737c501055a2
SSDEEP 768:AcD9pGXxnejw2Yo3N0NjtLY2Q1zSpQ7xec5i2lBiIACboAkXn+jFzQdjxXha5:nmB80JtRW0QFeki0BhoAkX+jU
MD5 SHA1 SHA512 SSDEEP

Submit Download

c8a523d3eb5ffdd5dbb657fb92ac5a09.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\c8a523d3eb5ffdd5dbb657fb92ac5a09.exe.bat
Size 352B
SHA256 c0591c9812214161a04e297e33ef4bee7f0586b342326f859a2c4d015df8b3de
MD5 d8055d4861549f506d999527b6f61a1b
SHA1 a662f28b939f1622e9158c7835ae95dff6ce7e95
SHA512 a12d7118330d93e0a40ecef936fc30620aafbe0492fad615d3415b22ad122d07d1b879ee5791ed4c9120ffe3bcb9f208137240a506bcf27705216c9beb08dc87
MD5 SHA1 SHA512