0a81ae3de62f0e798a085c2b0a819dee6e1caea7c0fcdb5d7285acc795a56f0c

Analysis

max time kernel
128s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 18:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a81ae3de62f0e798a085c2b0a819dee6e1caea7c0fcdb5d7285acc795a56f0c.exe
Size

90KB
MD5

3ab7c7112b2391561164bf667afed03b
SHA1

9bd258958778997f8cccd51b59f6b69d28e3b329
SHA256

0a81ae3de62f0e798a085c2b0a819dee6e1caea7c0fcdb5d7285acc795a56f0c
SHA512

d13082c4645434989686928995c7938a5f8545f4cf9ae9f5001ac808b1975b318dc393b243bfba297bda76441b1d051f47bdd01ef6a703a59a6c445982e478e5
SSDEEP

1536:jeXTIS4jXepeE1a5VI4To6JfYBEb2s8Qtbl31UjB3bcebKY2/:jTS4jXO4TFMEnRG1oeS

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2852	apsoct.exe

Loads dropped DLL 1 IoCs

pid	Process
2768	0a81ae3de62f0e798a085c2b0a819dee6e1caea7c0fcdb5d7285acc795a56f0c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2852	2768	0a81ae3de62f0e798a085c2b0a819dee6e1caea7c0fcdb5d7285acc795a56f0c.exe	28
PID 2768 wrote to memory of 2852	2768	0a81ae3de62f0e798a085c2b0a819dee6e1caea7c0fcdb5d7285acc795a56f0c.exe	28
PID 2768 wrote to memory of 2852	2768	0a81ae3de62f0e798a085c2b0a819dee6e1caea7c0fcdb5d7285acc795a56f0c.exe	28
PID 2768 wrote to memory of 2852	2768	0a81ae3de62f0e798a085c2b0a819dee6e1caea7c0fcdb5d7285acc795a56f0c.exe	28

C:\Users\Admin\AppData\Local\Temp\0a81ae3de62f0e798a085c2b0a819dee6e1caea7c0fcdb5d7285acc795a56f0c.exe
"C:\Users\Admin\AppData\Local\Temp\0a81ae3de62f0e798a085c2b0a819dee6e1caea7c0fcdb5d7285acc795a56f0c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Users\Admin\AppData\Local\Temp\apsoct.exe
  "C:\Users\Admin\AppData\Local\Temp\apsoct.exe"
  2⤵
  - Executes dropped EXE
  PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\apsoct.exe

Filesize
90KB

MD5
decf8e295bc6b0ce4b02bfb4c29e8c36

SHA1
13dc93d194635dfaba2c323158b18b88107b266b

SHA256
9fd1370762309e18b32ed773c0aac717acb5ed975743412d7287bf7ccb0356ab

SHA512
a4d211ba7cd07554d0330def40226b60d7ae6884998b72c11bfd23c2c3cb950a43cc946608992d249997ae05a666d186501649327fdafc040c6f861be2d091a0

Download Submit
memory/2768-0-0x0000000004000000-0x0000000004006000-memory.dmp

Filesize
24KB

Download
memory/2768-1-0x0000000004000000-0x0000000004006000-memory.dmp

Filesize
24KB

Download