2b8a4f8bdd3439ffc785bb61beef5b02aed6bca1e4274b1af19713c9292856a6

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 10:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b8a4f8bdd3439ffc785bb61beef5b02aed6bca1e4274b1af19713c9292856a6.exe
Size

37KB
MD5

c07d1428f7f720dfa92d4711126caa24
SHA1

3d30754db14be168df8b62c99876538d2b421262
SHA256

2b8a4f8bdd3439ffc785bb61beef5b02aed6bca1e4274b1af19713c9292856a6
SHA512

4e264b31f41038bd1d0ee8465321d22c3427f6ab80bccd4f89ceb61c0b61561d1e94bcf7f454d8b39431534b093cce83a1466659b6492a0e04435552c7a59bdb
SSDEEP

768:fTz7y3lhsT+hs1SQtOOtEvwDpjfAu9+4h6f:fT+hsMQMOtEvwDpjoIHh6f

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3048	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2240	2b8a4f8bdd3439ffc785bb61beef5b02aed6bca1e4274b1af19713c9292856a6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 3048	2240	2b8a4f8bdd3439ffc785bb61beef5b02aed6bca1e4274b1af19713c9292856a6.exe	28
PID 2240 wrote to memory of 3048	2240	2b8a4f8bdd3439ffc785bb61beef5b02aed6bca1e4274b1af19713c9292856a6.exe	28
PID 2240 wrote to memory of 3048	2240	2b8a4f8bdd3439ffc785bb61beef5b02aed6bca1e4274b1af19713c9292856a6.exe	28
PID 2240 wrote to memory of 3048	2240	2b8a4f8bdd3439ffc785bb61beef5b02aed6bca1e4274b1af19713c9292856a6.exe	28

C:\Users\Admin\AppData\Local\Temp\2b8a4f8bdd3439ffc785bb61beef5b02aed6bca1e4274b1af19713c9292856a6.exe
"C:\Users\Admin\AppData\Local\Temp\2b8a4f8bdd3439ffc785bb61beef5b02aed6bca1e4274b1af19713c9292856a6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
38KB

MD5
36d1c5126735f9ff1e578c8123294c1b

SHA1
d70860a7f2d10aa291752548f01f1fbdd3aae2af

SHA256
b7a62ab94890ded895df80fdcb531af1ab717b6ef8179c47146eed66b95d6ad2

SHA512
373df60177f237ce31db22ac4543008848bb9c386315a99ae32df1926b08e431f5379cc2a73dbc4c093f71e5deb4cf9442a251c222b90f82212b40a9aa419724

Download Submit
memory/2240-0-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2240-2-0x00000000003F0000-0x00000000003F6000-memory.dmp

Filesize
24KB

Download
memory/2240-8-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/3048-22-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/3048-15-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download