8f62aed8612acff54c700caa6eaea102a80ec6f145e152fe8be05e6bb7d29c83

Analysis

max time kernel
165s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-04-2024 22:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f62aed8612acff54c700caa6eaea102a80ec6f145e152fe8be05e6bb7d29c83.exe
Size

49KB
MD5

3092a5e779e7c58ff738de2b72304dc6
SHA1

03899234509ba9e59f4ce149e0b2c43f996780e8
SHA256

8f62aed8612acff54c700caa6eaea102a80ec6f145e152fe8be05e6bb7d29c83
SHA512

5a8786fba323499ef9efa008688c53577b52dc3693a256e5f21efdd4fcb65fbd5258b4fe1a88d768454462f58c28500635c451218f6c89c037992322b3e43b6f
SSDEEP

1536:PwP9999999996FoYkytbdH4zd7JoISHm3y:P4UDN

Score

9^/10

Malware Config

Signatures

Detects executables built or packed with MPress PE compressor 5 IoCs

resource	yara_rule
behavioral1/memory/2352-0-0x0000000000400000-0x000000000040C000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2352-2-0x0000000000400000-0x000000000040C000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x000a0000000141af-4.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2548-8-0x0000000000400000-0x000000000040C000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2548-10-0x0000000000400000-0x000000000040C000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 1 IoCs

pid	Process
2548	lsemc.exe

Loads dropped DLL 1 IoCs

pid	Process
2352	8f62aed8612acff54c700caa6eaea102a80ec6f145e152fe8be05e6bb7d29c83.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2548	2352	8f62aed8612acff54c700caa6eaea102a80ec6f145e152fe8be05e6bb7d29c83.exe	27
PID 2352 wrote to memory of 2548	2352	8f62aed8612acff54c700caa6eaea102a80ec6f145e152fe8be05e6bb7d29c83.exe	27
PID 2352 wrote to memory of 2548	2352	8f62aed8612acff54c700caa6eaea102a80ec6f145e152fe8be05e6bb7d29c83.exe	27
PID 2352 wrote to memory of 2548	2352	8f62aed8612acff54c700caa6eaea102a80ec6f145e152fe8be05e6bb7d29c83.exe	27

C:\Users\Admin\AppData\Local\Temp\8f62aed8612acff54c700caa6eaea102a80ec6f145e152fe8be05e6bb7d29c83.exe
"C:\Users\Admin\AppData\Local\Temp\8f62aed8612acff54c700caa6eaea102a80ec6f145e152fe8be05e6bb7d29c83.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Users\Admin\AppData\Local\Temp\lsemc.exe
  "C:\Users\Admin\AppData\Local\Temp\lsemc.exe"
  2⤵
  - Executes dropped EXE
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\lsemc.exe

Filesize
50KB

MD5
82fde595d87d376494bc120753de81f4

SHA1
c623556c1661f24de357838f9abcef30919588e7

SHA256
2a851f6fa0e7b7c1be6c0cad184d387c233205dc602e0f6e30f26c9917b61810

SHA512
b9ce9ea1aa688f2f4e5f2112b78eb50326ae15a9038eeae2b85db05dc528bd53a3eac783ad5d0f5332bab4bb87126613b5e5f94804ce63c3e6b018d54ae13ec1

Download Submit
memory/2352-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2352-2-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2548-8-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2548-10-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download