974dee1b8ccdad03fcbed6849802dd1d25d3d4c655749fd910733746a1b1f3c2

Analysis

max time kernel
79s
max time network
77s
platform
windows7_x64
resource
win7v20201028
submitted
09-11-2020 20:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b942a08d9081a5c7898d144968da204f.exe
Size

1.1MB
MD5

b942a08d9081a5c7898d144968da204f
SHA1

d5a51d3f1e77e0d57228e4e8d7dda70b6d10db66
SHA256

974dee1b8ccdad03fcbed6849802dd1d25d3d4c655749fd910733746a1b1f3c2
SHA512

84bcd0fb7dfa24ed3498489ffd32741e21368ac91c3f100e91e8a66144cceac401b5d0c5121e58d5165c850a06a594e0e86430acdf8d94c93fe78db64a433598

Score

1^/10

Malware Config

Signatures

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1660 PING.EXE
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

b942a08d9081a5c7898d144968da204f.exeb942a08d9081a5c7898d144968da204f.exe

pid process

1688 b942a08d9081a5c7898d144968da204f.exe
1552 b942a08d9081a5c7898d144968da204f.exe
1552 b942a08d9081a5c7898d144968da204f.exe

pid	process
1660	PING.EXE

pid	process
1688	b942a08d9081a5c7898d144968da204f.exe
1552	b942a08d9081a5c7898d144968da204f.exe
1552	b942a08d9081a5c7898d144968da204f.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

b942a08d9081a5c7898d144968da204f.execmd.exe

description	pid	process	target process
PID 1688 wrote to memory of 1552	1688	b942a08d9081a5c7898d144968da204f.exe	b942a08d9081a5c7898d144968da204f.exe
PID 1688 wrote to memory of 1552	1688	b942a08d9081a5c7898d144968da204f.exe	b942a08d9081a5c7898d144968da204f.exe
PID 1688 wrote to memory of 1552	1688	b942a08d9081a5c7898d144968da204f.exe	b942a08d9081a5c7898d144968da204f.exe
PID 1688 wrote to memory of 1552	1688	b942a08d9081a5c7898d144968da204f.exe	b942a08d9081a5c7898d144968da204f.exe
PID 1688 wrote to memory of 848	1688	b942a08d9081a5c7898d144968da204f.exe	cmd.exe
PID 1688 wrote to memory of 848	1688	b942a08d9081a5c7898d144968da204f.exe	cmd.exe
PID 1688 wrote to memory of 848	1688	b942a08d9081a5c7898d144968da204f.exe	cmd.exe
PID 1688 wrote to memory of 848	1688	b942a08d9081a5c7898d144968da204f.exe	cmd.exe
PID 848 wrote to memory of 1660	848	cmd.exe	PING.EXE
PID 848 wrote to memory of 1660	848	cmd.exe	PING.EXE
PID 848 wrote to memory of 1660	848	cmd.exe	PING.EXE
PID 848 wrote to memory of 1660	848	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\b942a08d9081a5c7898d144968da204f.exe
"C:\Users\Admin\AppData\Local\Temp\b942a08d9081a5c7898d144968da204f.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1688

C:\Users\Admin\AppData\Local\Temp\b942a08d9081a5c7898d144968da204f.exe
C:\Users\Admin\AppData\Local\Temp\b942a08d9081a5c7898d144968da204f.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1552

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\b942a08d9081a5c7898d144968da204f.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:848

C:\Windows\SysWOW64\PING.EXE
ping.exe -n 6 127.0.0.1
3⤵
- Runs ping.exe
PID:1660

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/848-2-0x0000000000000000-mapping.dmp

Download
memory/1552-0-0x0000000000000000-mapping.dmp

Download
memory/1552-1-0x0000000002370000-0x0000000002381000-memory.dmp

Filesize
68KB

Download
memory/1660-3-0x0000000000000000-mapping.dmp

Download