c58940e47f74769b425de431fd74357c8de0cf9f979d82d37cdcf42fcaaeac32

Analysis

max time kernel
10s
max time network
151s
platform
windows10_x64
resource
win10v20210410
submitted
27-07-2021 02:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c58.exe
Size

558KB
MD5

986d7605da3d124d71916c6da5d16f36
SHA1

ef9a140dc79bf2cdaf2c3bd4d9928f57af60702f
SHA256

c58940e47f74769b425de431fd74357c8de0cf9f979d82d37cdcf42fcaaeac32
SHA512

244ae8f6927805312391a9e6878ea9730eb859f0d269b4065bc159b7761fe14c38a4af7732b1f096d30ff2b109d095cbe365e144859005d1898505548b12d707

Score

1^/10

Malware Config

Signatures

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2456 PING.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

c58.exe

pid process

2752 c58.exe
2752 c58.exe

pid	process
2456	PING.EXE

pid	process
2752	c58.exe
2752	c58.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

c58.execmd.exe

description	pid	process	target process
PID 2752 wrote to memory of 1720	2752	c58.exe	cmd.exe
PID 2752 wrote to memory of 1720	2752	c58.exe	cmd.exe
PID 2752 wrote to memory of 1720	2752	c58.exe	cmd.exe
PID 1720 wrote to memory of 2456	1720	cmd.exe	PING.EXE
PID 1720 wrote to memory of 2456	1720	cmd.exe	PING.EXE
PID 1720 wrote to memory of 2456	1720	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\c58.exe
"C:\Users\Admin\AppData\Local\Temp\c58.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2752

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\c58.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1720

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
3⤵
- Runs ping.exe
PID:2456

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1720-114-0x0000000000000000-mapping.dmp

Download
memory/2456-115-0x0000000000000000-mapping.dmp

Download