2cad1d5cd3e145f720e3da8825183d78545b834fe146a8d1ec26c0e876980a66

Analysis

max time kernel
124s
max time network
135s
platform
windows10_x64
resource
win10v20201028
submitted
10/01/2021, 13:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
other.exe
Size 927KB
Sample210110-dxa1xbfb42
SHA256 2cad1d5cd3e145f720e3da8825183d78545b834fe146a8d1ec26c0e876980a66
MD5 c0fc0187c148b182981ad72e90e93b26
SHA1 7c6b558731fec3a5ae6ff5de413988d4ba2631cd
SHA512 ce43c86bc901c4c24d4a35dadda9f5953ae8da3d8693d46777fb50c20edd1259df85833189ff4606afe339bafc8d6f7fd284ea27e5a8cd35a063bb7ce6e6d597
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2704	rundll32.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2704 set thread context of 1908	2704	rundll32.com	85

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
196	PING.EXE
4064	PING.EXE

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 3980	2868	other.exe	75
PID 2868 wrote to memory of 3980	2868	other.exe	75
PID 2868 wrote to memory of 3980	2868	other.exe	75
PID 2868 wrote to memory of 3884	2868	other.exe	77
PID 2868 wrote to memory of 3884	2868	other.exe	77
PID 2868 wrote to memory of 3884	2868	other.exe	77
PID 3884 wrote to memory of 2468	3884	cmd.exe	79
PID 3884 wrote to memory of 2468	3884	cmd.exe	79
PID 3884 wrote to memory of 2468	3884	cmd.exe	79
PID 2468 wrote to memory of 196	2468	cmd.exe	80
PID 2468 wrote to memory of 196	2468	cmd.exe	80
PID 2468 wrote to memory of 196	2468	cmd.exe	80
PID 2468 wrote to memory of 3036	2468	cmd.exe	81
PID 2468 wrote to memory of 3036	2468	cmd.exe	81
PID 2468 wrote to memory of 3036	2468	cmd.exe	81
PID 2468 wrote to memory of 3604	2468	cmd.exe	82
PID 2468 wrote to memory of 3604	2468	cmd.exe	82
PID 2468 wrote to memory of 3604	2468	cmd.exe	82
PID 2468 wrote to memory of 2704	2468	cmd.exe	83
PID 2468 wrote to memory of 2704	2468	cmd.exe	83
PID 2468 wrote to memory of 2704	2468	cmd.exe	83
PID 2468 wrote to memory of 4064	2468	cmd.exe	84
PID 2468 wrote to memory of 4064	2468	cmd.exe	84
PID 2468 wrote to memory of 4064	2468	cmd.exe	84
PID 2704 wrote to memory of 1908	2704	rundll32.com	85
PID 2704 wrote to memory of 1908	2704	rundll32.com	85
PID 2704 wrote to memory of 1908	2704	rundll32.com	85
PID 2704 wrote to memory of 1908	2704	rundll32.com	85
PID 2704 wrote to memory of 1908	2704	rundll32.com	85
PID 2704 wrote to memory of 1908	2704	rundll32.com	85
PID 2704 wrote to memory of 1908	2704	rundll32.com	85
PID 2704 wrote to memory of 1908	2704	rundll32.com	85

C:\Users\Admin\AppData\Local\Temp\other.exe
"C:\Users\Admin\AppData\Local\Temp\other.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo elyfkjbkl
  2⤵
  PID:3980
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cmd < rbgakiwge.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2468
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 gduzuextm
      4⤵
      Runs ping.exe
      PID:196
  - - C:\Windows\SysWOW64\certutil.exe
      certutil -decode vweyokbgl.com rundll32.com
      4⤵
      PID:3036
  - - C:\Windows\SysWOW64\certutil.exe
      certutil -decode fzhgstpmz.com Q
      4⤵
      PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rundll32.com
      rundll32.com Q
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:2704
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
        5⤵
        
        PID:1908
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 gduzuextm
      4⤵
      Runs ping.exe
      PID:4064

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1908-18-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/1908-20-0x0000000071FA0000-0x000000007268E000-memory.dmp

Download

memory/1908-23-0x0000000005320000-0x0000000005321000-memory.dmp

Download

memory/1908-25-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads