Analysis
-
max time kernel
110s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07/11/2024, 10:10
Behavioral task
behavioral1
Sample
516a230554fd6944f952ef94a42651d2751956899b233a3fa7fa6287a868de20N.exe
Resource
win7-20240903-en
General
-
Target
516a230554fd6944f952ef94a42651d2751956899b233a3fa7fa6287a868de20N.exe
-
Size
92KB
-
MD5
9e70e5eac000ba74f5edfc4b05616680
-
SHA1
0fcc245847c61c1fec2e631407af42c1dc81b995
-
SHA256
516a230554fd6944f952ef94a42651d2751956899b233a3fa7fa6287a868de20
-
SHA512
12278ccbf614250674151c7707e5a553a88cfcc0cbc62b9f18421b5d5f115d91bfa4721e10c48f796b8715678ca66d15acda94e7822eda8ebe36cb72aa77b66a
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgpYk:AnBdOOtEvwDpj6zm
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1228 asih.exe -
Loads dropped DLL 1 IoCs
pid Process 2500 516a230554fd6944f952ef94a42651d2751956899b233a3fa7fa6287a868de20N.exe -
resource yara_rule behavioral1/memory/2500-0-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/files/0x000b000000012029-11.dat upx behavioral1/memory/2500-15-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/1228-26-0x0000000000500000-0x000000000050F000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 516a230554fd6944f952ef94a42651d2751956899b233a3fa7fa6287a868de20N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language asih.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2500 wrote to memory of 1228 2500 516a230554fd6944f952ef94a42651d2751956899b233a3fa7fa6287a868de20N.exe 30 PID 2500 wrote to memory of 1228 2500 516a230554fd6944f952ef94a42651d2751956899b233a3fa7fa6287a868de20N.exe 30 PID 2500 wrote to memory of 1228 2500 516a230554fd6944f952ef94a42651d2751956899b233a3fa7fa6287a868de20N.exe 30 PID 2500 wrote to memory of 1228 2500 516a230554fd6944f952ef94a42651d2751956899b233a3fa7fa6287a868de20N.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\516a230554fd6944f952ef94a42651d2751956899b233a3fa7fa6287a868de20N.exe"C:\Users\Admin\AppData\Local\Temp\516a230554fd6944f952ef94a42651d2751956899b233a3fa7fa6287a868de20N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1228
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD59d710a8292f37676d8ca4bb75fbccbdc
SHA1ba85f1c3c335a837b00825c1e019b0b12592a80e
SHA256b163fa1f3f986b15f53fcdd0dcdf9d5df6039dbc14669b544def316838e3e96e
SHA512a4b82529dd206e01e54701923ace19039e74a167ef5b9bce68e8254361e59d96555472383a5edfa0c3d3978ef265c8d445dc7bc846faa568621de844864d05b4