7e00e2f5bcbb37e95022c1734f146d6232ad0a9f86d0cf1329de6cf600f829da

Analysis

max time kernel
19s
max time network
13s
platform
windows7_x64
resource
win7v20201028
submitted
09-11-2020 19:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac0dcb5f89023442bd8d41646f8c808c.exe
Size

2.0MB
MD5

ac0dcb5f89023442bd8d41646f8c808c
SHA1

b44eb37711858f0c861f0ed0a6739ff9fdc17c7a
SHA256

7e00e2f5bcbb37e95022c1734f146d6232ad0a9f86d0cf1329de6cf600f829da
SHA512

98bc1ab4b06e754f5e613340eab743e3ec9143a9622da0fe21c5678093c5cb36406769aa01e808cb4728a56998de797844004d1fb9be2b9f630760f8d80d5a3a

Score

1^/10

Malware Config

Signatures

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1620 PING.EXE
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

ac0dcb5f89023442bd8d41646f8c808c.exeac0dcb5f89023442bd8d41646f8c808c.exe

pid process

1876 ac0dcb5f89023442bd8d41646f8c808c.exe
1788 ac0dcb5f89023442bd8d41646f8c808c.exe
1788 ac0dcb5f89023442bd8d41646f8c808c.exe

pid	process
1620	PING.EXE

pid	process
1876	ac0dcb5f89023442bd8d41646f8c808c.exe
1788	ac0dcb5f89023442bd8d41646f8c808c.exe
1788	ac0dcb5f89023442bd8d41646f8c808c.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

ac0dcb5f89023442bd8d41646f8c808c.execmd.exe

description	pid	process	target process
PID 1876 wrote to memory of 1788	1876	ac0dcb5f89023442bd8d41646f8c808c.exe	ac0dcb5f89023442bd8d41646f8c808c.exe
PID 1876 wrote to memory of 1788	1876	ac0dcb5f89023442bd8d41646f8c808c.exe	ac0dcb5f89023442bd8d41646f8c808c.exe
PID 1876 wrote to memory of 1788	1876	ac0dcb5f89023442bd8d41646f8c808c.exe	ac0dcb5f89023442bd8d41646f8c808c.exe
PID 1876 wrote to memory of 1788	1876	ac0dcb5f89023442bd8d41646f8c808c.exe	ac0dcb5f89023442bd8d41646f8c808c.exe
PID 1876 wrote to memory of 1772	1876	ac0dcb5f89023442bd8d41646f8c808c.exe	cmd.exe
PID 1876 wrote to memory of 1772	1876	ac0dcb5f89023442bd8d41646f8c808c.exe	cmd.exe
PID 1876 wrote to memory of 1772	1876	ac0dcb5f89023442bd8d41646f8c808c.exe	cmd.exe
PID 1876 wrote to memory of 1772	1876	ac0dcb5f89023442bd8d41646f8c808c.exe	cmd.exe
PID 1772 wrote to memory of 1620	1772	cmd.exe	PING.EXE
PID 1772 wrote to memory of 1620	1772	cmd.exe	PING.EXE
PID 1772 wrote to memory of 1620	1772	cmd.exe	PING.EXE
PID 1772 wrote to memory of 1620	1772	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\ac0dcb5f89023442bd8d41646f8c808c.exe
"C:\Users\Admin\AppData\Local\Temp\ac0dcb5f89023442bd8d41646f8c808c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1876

C:\Users\Admin\AppData\Local\Temp\ac0dcb5f89023442bd8d41646f8c808c.exe
C:\Users\Admin\AppData\Local\Temp\ac0dcb5f89023442bd8d41646f8c808c.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1788

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\ac0dcb5f89023442bd8d41646f8c808c.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1772

C:\Windows\SysWOW64\PING.EXE
ping.exe -n 6 127.0.0.1
3⤵
- Runs ping.exe
PID:1620

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1620-3-0x0000000000000000-mapping.dmp

Download
memory/1772-2-0x0000000000000000-mapping.dmp

Download
memory/1788-0-0x0000000000000000-mapping.dmp

Download
memory/1788-1-0x0000000002500000-0x0000000002511000-memory.dmp

Filesize
68KB

Download