b88584dde985bb05eef183a2f339bef9ebdf7adf3b7ce58a71e78e638e6a2123

Analysis

max time kernel
3s
max time network
9s
platform
windows7_x64
resource
win7v20201028
submitted
10/04/2021, 13:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 704KB
Sample210410-m7cdl15spe
SHA256 b88584dde985bb05eef183a2f339bef9ebdf7adf3b7ce58a71e78e638e6a2123
MD5 b749832e5d6ebfc73a61cde48a1b890b
SHA1 a6b4fda0e4ab8137b6e8cdfea85ba66ff4b11b4b
SHA512 fc197954eaa1b651ed8dc1b32b6547542281633acbfcd29a3acbb4eb5859a9aad00effcce40d76115ffbb8d0ee189b25813beabeafabee2d419dee6fa8383a21
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1688	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1568	PING.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 1688	1336	setup.exe	29
PID 1336 wrote to memory of 1688	1336	setup.exe	29
PID 1336 wrote to memory of 1688	1336	setup.exe	29
PID 1336 wrote to memory of 1688	1336	setup.exe	29
PID 1688 wrote to memory of 1568	1688	cmd.exe	31
PID 1688 wrote to memory of 1568	1688	cmd.exe	31
PID 1688 wrote to memory of 1568	1688	cmd.exe	31
PID 1688 wrote to memory of 1568	1688	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\setup.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 3000
    3⤵
    - Runs ping.exe
    PID:1568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1336-59-0x0000000075DE1000-0x0000000075DE3000-memory.dmp

Download