Analysis
-
max time kernel
123s -
max time network
126s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
08-11-2020 18:38
Behavioral task
behavioral1
Sample
f97484e95aacf21edc625644bb5c5ee62cdb2d7fcf7c5682882b90b3d3730607.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
f97484e95aacf21edc625644bb5c5ee62cdb2d7fcf7c5682882b90b3d3730607.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
f97484e95aacf21edc625644bb5c5ee62cdb2d7fcf7c5682882b90b3d3730607.exe
-
Size
2.0MB
-
MD5
2ac605b6aac40e5cae86863c959f341e
-
SHA1
e230f54fd40245c851401bd35a6d5617560df3c2
-
SHA256
f97484e95aacf21edc625644bb5c5ee62cdb2d7fcf7c5682882b90b3d3730607
-
SHA512
02fb9e753778b303d91c692d15c8b9d29681a04024eeee723506b727f5c7d274ef7ef343b1c1cfab8934220e072356f58ad3bc894c62d2101600e842f347b3da
Score
1/10
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f97484e95aacf21edc625644bb5c5ee62cdb2d7fcf7c5682882b90b3d3730607.exef97484e95aacf21edc625644bb5c5ee62cdb2d7fcf7c5682882b90b3d3730607.exepid process 1056 f97484e95aacf21edc625644bb5c5ee62cdb2d7fcf7c5682882b90b3d3730607.exe 1488 f97484e95aacf21edc625644bb5c5ee62cdb2d7fcf7c5682882b90b3d3730607.exe 1488 f97484e95aacf21edc625644bb5c5ee62cdb2d7fcf7c5682882b90b3d3730607.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
f97484e95aacf21edc625644bb5c5ee62cdb2d7fcf7c5682882b90b3d3730607.execmd.exedescription pid process target process PID 1056 wrote to memory of 1488 1056 f97484e95aacf21edc625644bb5c5ee62cdb2d7fcf7c5682882b90b3d3730607.exe f97484e95aacf21edc625644bb5c5ee62cdb2d7fcf7c5682882b90b3d3730607.exe PID 1056 wrote to memory of 1488 1056 f97484e95aacf21edc625644bb5c5ee62cdb2d7fcf7c5682882b90b3d3730607.exe f97484e95aacf21edc625644bb5c5ee62cdb2d7fcf7c5682882b90b3d3730607.exe PID 1056 wrote to memory of 1488 1056 f97484e95aacf21edc625644bb5c5ee62cdb2d7fcf7c5682882b90b3d3730607.exe f97484e95aacf21edc625644bb5c5ee62cdb2d7fcf7c5682882b90b3d3730607.exe PID 1056 wrote to memory of 1488 1056 f97484e95aacf21edc625644bb5c5ee62cdb2d7fcf7c5682882b90b3d3730607.exe f97484e95aacf21edc625644bb5c5ee62cdb2d7fcf7c5682882b90b3d3730607.exe PID 1056 wrote to memory of 1584 1056 f97484e95aacf21edc625644bb5c5ee62cdb2d7fcf7c5682882b90b3d3730607.exe cmd.exe PID 1056 wrote to memory of 1584 1056 f97484e95aacf21edc625644bb5c5ee62cdb2d7fcf7c5682882b90b3d3730607.exe cmd.exe PID 1056 wrote to memory of 1584 1056 f97484e95aacf21edc625644bb5c5ee62cdb2d7fcf7c5682882b90b3d3730607.exe cmd.exe PID 1056 wrote to memory of 1584 1056 f97484e95aacf21edc625644bb5c5ee62cdb2d7fcf7c5682882b90b3d3730607.exe cmd.exe PID 1584 wrote to memory of 1632 1584 cmd.exe PING.EXE PID 1584 wrote to memory of 1632 1584 cmd.exe PING.EXE PID 1584 wrote to memory of 1632 1584 cmd.exe PING.EXE PID 1584 wrote to memory of 1632 1584 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\f97484e95aacf21edc625644bb5c5ee62cdb2d7fcf7c5682882b90b3d3730607.exe"C:\Users\Admin\AppData\Local\Temp\f97484e95aacf21edc625644bb5c5ee62cdb2d7fcf7c5682882b90b3d3730607.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\f97484e95aacf21edc625644bb5c5ee62cdb2d7fcf7c5682882b90b3d3730607.exeC:\Users\Admin\AppData\Local\Temp\f97484e95aacf21edc625644bb5c5ee62cdb2d7fcf7c5682882b90b3d3730607.exe /C2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1488 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\f97484e95aacf21edc625644bb5c5ee62cdb2d7fcf7c5682882b90b3d3730607.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\PING.EXEping.exe -n 6 127.0.0.13⤵
- Runs ping.exe
PID:1632