Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 01:02
Behavioral task
behavioral1
Sample
4ea367e656c4ba8bafb5dc9d368f3ce4.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4ea367e656c4ba8bafb5dc9d368f3ce4.exe
Resource
win10v2004-20240226-en
General
-
Target
4ea367e656c4ba8bafb5dc9d368f3ce4.exe
-
Size
40KB
-
MD5
4ea367e656c4ba8bafb5dc9d368f3ce4
-
SHA1
ecfbc925e391eec18d68915382fb1d5b0feac387
-
SHA256
ef756a8ddd2c014ee73eb30f5a9ccbd1d70111c785e065d05d0f1750e148fd50
-
SHA512
e1375c82af5844fcace3ba5c847f478f20b60cbb9ad705137b6a784681708e4586e6f432071b33ec67eecfb6f6f2d37489f8f7c554721b8bca2eff5d4441daae
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITY//:qDdFJy3QMOtEvwDpjjWMl7T2
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2884 asih.exe -
Loads dropped DLL 1 IoCs
pid Process 1664 4ea367e656c4ba8bafb5dc9d368f3ce4.exe -
resource yara_rule behavioral1/memory/1664-0-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/files/0x000d000000014909-11.dat upx behavioral1/memory/1664-16-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/2884-17-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/2884-27-0x0000000000500000-0x0000000000510000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1664 wrote to memory of 2884 1664 4ea367e656c4ba8bafb5dc9d368f3ce4.exe 28 PID 1664 wrote to memory of 2884 1664 4ea367e656c4ba8bafb5dc9d368f3ce4.exe 28 PID 1664 wrote to memory of 2884 1664 4ea367e656c4ba8bafb5dc9d368f3ce4.exe 28 PID 1664 wrote to memory of 2884 1664 4ea367e656c4ba8bafb5dc9d368f3ce4.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ea367e656c4ba8bafb5dc9d368f3ce4.exe"C:\Users\Admin\AppData\Local\Temp\4ea367e656c4ba8bafb5dc9d368f3ce4.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:2884
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD51359f2923906861cf2deeb280afe4130
SHA1f85564cee0165fe4dadf9dff5ed578247c5b6f80
SHA2565627f10e8ff1ccc74611ade4796c66e23d70b030926735133c52071171c6fede
SHA5120ee684a491a614397697ad2e60f5895a7c5e3a05f119647d4d984150a26874762bf3231b91f8b073587eb1fc8c5f5cc6cb3a3adea68b32ad44774d26622d3a85