dbe1cab445ef128afda621e5a8e7190020631db12ba076668f7e100b75d06092

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 02:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8a799f5da1f9ce3035ec9d598794bb6.exe
Size

127KB
MD5

b8a799f5da1f9ce3035ec9d598794bb6
SHA1

ffbb99a9319e0f9025fd0b8c41cca0d5994caf3d
SHA256

dbe1cab445ef128afda621e5a8e7190020631db12ba076668f7e100b75d06092
SHA512

ce7cf9fc7bb5f82be34835561080876729ff53bb125fd53a7a9f749979eef24e9357996cfa27d6ff1c25602d2f1052113ff4f93b40a9731f5b45195b9329ffd3
SSDEEP

1536:gUj+AIMOtEvwDpjNbwQEIPlemUhYwkkxGBpR/e:vCA9OtEvwDpjw

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2252	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2168	b8a799f5da1f9ce3035ec9d598794bb6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2252	2168	b8a799f5da1f9ce3035ec9d598794bb6.exe	28
PID 2168 wrote to memory of 2252	2168	b8a799f5da1f9ce3035ec9d598794bb6.exe	28
PID 2168 wrote to memory of 2252	2168	b8a799f5da1f9ce3035ec9d598794bb6.exe	28
PID 2168 wrote to memory of 2252	2168	b8a799f5da1f9ce3035ec9d598794bb6.exe	28

C:\Users\Admin\AppData\Local\Temp\b8a799f5da1f9ce3035ec9d598794bb6.exe
"C:\Users\Admin\AppData\Local\Temp\b8a799f5da1f9ce3035ec9d598794bb6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
127KB

MD5
e985c576fd9ec2a69978ef3e078534bc

SHA1
f448fc2fd665765c6d123eaafebdda5ef777c357

SHA256
d26a661d3bfcac196b3d00fee2877194bf7453864ca51ce7cb67eb4ff2434c7a

SHA512
d4b5dea2e2e75fa137cb9374db1b6660fbd92b032892151fdb07540bbd71ae05ee65ce82204ba5c8af1215b809af6076364caa3dafd53d99950f1d25e5a1ef3e

Download Submit
memory/2168-0-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2168-1-0x00000000002E0000-0x00000000002E6000-memory.dmp

Filesize
24KB

Download
memory/2168-3-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2252-16-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2252-15-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download