91f4b7ae747bfd036882e084650f608782b6054ecc8ab32f5fe91b91caf80e5d

Resubmissions

12-08-2021 21:22

12-08-2021 20:38

Target

Bot_Checker.exe
Size

56KB
MD5

391ca27e1e5cc0da88d1fcc8df1d0d85
SHA1

25bd7c5b7d88bcd01610226fccb0910b48dc1eee
SHA256

a9ee4862c1e7931ef8366b090ac1f3212e79cc17d7737f537978d9a3fb0c5ef1
SHA512

2dbb84eb664798766a669c7d407be76d5154bd7d0b99f2c2371ad0ae3e1124605df0771b228f7a3406f023fa9cbba3022afb5b48207cf1eb14d94cda7a5117f9

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Bot_Checker.exe

description	pid	process	target process
PID 748 wrote to memory of 1992	748	Bot_Checker.exe	Bot_Checker.exe
PID 748 wrote to memory of 1992	748	Bot_Checker.exe	Bot_Checker.exe
PID 748 wrote to memory of 1992	748	Bot_Checker.exe	Bot_Checker.exe
PID 748 wrote to memory of 1992	748	Bot_Checker.exe	Bot_Checker.exe

C:\Users\Admin\AppData\Local\Temp\Bot_Checker.exe
"C:\Users\Admin\AppData\Local\Temp\Bot_Checker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:748
- C:\Users\Admin\AppData\Local\Temp\Bot_Checker.exe
  "C:\Users\Admin\AppData\Local\Temp\Bot_Checker.exe" -a
  2⤵
  PID:1992

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/748-60-0x0000000076661000-0x0000000076663000-memory.dmp

Filesize
8KB

Download
memory/1992-61-0x0000000000000000-mapping.dmp

Download