Analysis
-
max time kernel
13s -
max time network
8s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
14-12-2020 23:58
Static task
static1
Behavioral task
behavioral1
Sample
b3869c8c61ce01dc2e8ef889c7f9cf5fa0bc92bf529654aae33d07d5fcc18811.bin.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
b3869c8c61ce01dc2e8ef889c7f9cf5fa0bc92bf529654aae33d07d5fcc18811.bin.exe
-
Size
203KB
-
MD5
b118d48f93298898291372087e0e7ba2
-
SHA1
81e8a390c05feb80c97b081d133f8f541e7b5b5d
-
SHA256
b3869c8c61ce01dc2e8ef889c7f9cf5fa0bc92bf529654aae33d07d5fcc18811
-
SHA512
1dd27aebf1a46fba1ec6809e413a38059f26458417910fa59e27004e7344b224a4bb0dce3d132c6cfe36c09f32294f68f933a2784a6a49bef9cdcd7cc47083e4
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
b3869c8c61ce01dc2e8ef889c7f9cf5fa0bc92bf529654aae33d07d5fcc18811.bin.exeb3869c8c61ce01dc2e8ef889c7f9cf5fa0bc92bf529654aae33d07d5fcc18811.bin.exepid process 1824 b3869c8c61ce01dc2e8ef889c7f9cf5fa0bc92bf529654aae33d07d5fcc18811.bin.exe 1700 b3869c8c61ce01dc2e8ef889c7f9cf5fa0bc92bf529654aae33d07d5fcc18811.bin.exe 1700 b3869c8c61ce01dc2e8ef889c7f9cf5fa0bc92bf529654aae33d07d5fcc18811.bin.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
b3869c8c61ce01dc2e8ef889c7f9cf5fa0bc92bf529654aae33d07d5fcc18811.bin.execmd.exedescription pid process target process PID 1824 wrote to memory of 1700 1824 b3869c8c61ce01dc2e8ef889c7f9cf5fa0bc92bf529654aae33d07d5fcc18811.bin.exe b3869c8c61ce01dc2e8ef889c7f9cf5fa0bc92bf529654aae33d07d5fcc18811.bin.exe PID 1824 wrote to memory of 1700 1824 b3869c8c61ce01dc2e8ef889c7f9cf5fa0bc92bf529654aae33d07d5fcc18811.bin.exe b3869c8c61ce01dc2e8ef889c7f9cf5fa0bc92bf529654aae33d07d5fcc18811.bin.exe PID 1824 wrote to memory of 1700 1824 b3869c8c61ce01dc2e8ef889c7f9cf5fa0bc92bf529654aae33d07d5fcc18811.bin.exe b3869c8c61ce01dc2e8ef889c7f9cf5fa0bc92bf529654aae33d07d5fcc18811.bin.exe PID 1824 wrote to memory of 1700 1824 b3869c8c61ce01dc2e8ef889c7f9cf5fa0bc92bf529654aae33d07d5fcc18811.bin.exe b3869c8c61ce01dc2e8ef889c7f9cf5fa0bc92bf529654aae33d07d5fcc18811.bin.exe PID 1824 wrote to memory of 1520 1824 b3869c8c61ce01dc2e8ef889c7f9cf5fa0bc92bf529654aae33d07d5fcc18811.bin.exe cmd.exe PID 1824 wrote to memory of 1520 1824 b3869c8c61ce01dc2e8ef889c7f9cf5fa0bc92bf529654aae33d07d5fcc18811.bin.exe cmd.exe PID 1824 wrote to memory of 1520 1824 b3869c8c61ce01dc2e8ef889c7f9cf5fa0bc92bf529654aae33d07d5fcc18811.bin.exe cmd.exe PID 1824 wrote to memory of 1520 1824 b3869c8c61ce01dc2e8ef889c7f9cf5fa0bc92bf529654aae33d07d5fcc18811.bin.exe cmd.exe PID 1520 wrote to memory of 340 1520 cmd.exe PING.EXE PID 1520 wrote to memory of 340 1520 cmd.exe PING.EXE PID 1520 wrote to memory of 340 1520 cmd.exe PING.EXE PID 1520 wrote to memory of 340 1520 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\b3869c8c61ce01dc2e8ef889c7f9cf5fa0bc92bf529654aae33d07d5fcc18811.bin.exe"C:\Users\Admin\AppData\Local\Temp\b3869c8c61ce01dc2e8ef889c7f9cf5fa0bc92bf529654aae33d07d5fcc18811.bin.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b3869c8c61ce01dc2e8ef889c7f9cf5fa0bc92bf529654aae33d07d5fcc18811.bin.exeC:\Users\Admin\AppData\Local\Temp\b3869c8c61ce01dc2e8ef889c7f9cf5fa0bc92bf529654aae33d07d5fcc18811.bin.exe /C2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\b3869c8c61ce01dc2e8ef889c7f9cf5fa0bc92bf529654aae33d07d5fcc18811.bin.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping.exe -n 6 127.0.0.13⤵
- Runs ping.exe