02065326c23d7dbb2e4d2ba63e4b428ac397d0814f04ea64515f4cf2e5818487 | Triage

Analysis

max time kernel
147s
max time network
124s
platform
windows10_x64
resource
win10v20210408
submitted
10-09-2021 18:51

Sharing

Report Analysis Logs

General

Target

core.bat
Size

222B
MD5

c1432ae7a15e7d43e44abeaa97bcc77d
SHA1

e348e5f29ed0d16511680f7b57a3b4feaf920026
SHA256

6422c2bff92af11fc31c710ca2e8bbe74a41b9e3db9103c64dd6e55baa0899f2
SHA512

cd73eac203805d233cac32e52aef6261611fa2c662346e3f83b4bc2b57d371ad9f81aee2a31531f3901a9eda03a32fb6a671d9c64b084e966de9cd5cb3ffd3cc

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

rundll32.exerundll32.exe

pid process

424 rundll32.exe
1044 rundll32.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

rundll32.exerundll32.exe

pid process

424 rundll32.exe
424 rundll32.exe
424 rundll32.exe
424 rundll32.exe
1044 rundll32.exe
1044 rundll32.exe
1044 rundll32.exe
1044 rundll32.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 664 wrote to memory of 424	664	cmd.exe	rundll32.exe
PID 664 wrote to memory of 424	664	cmd.exe	rundll32.exe
PID 664 wrote to memory of 1044	664	cmd.exe	rundll32.exe
PID 664 wrote to memory of 1044	664	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\core.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:664

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vessel-64.dat,DllMain /i="license.dat"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:424

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vessel-64.dat,update /i="license.dat"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1044

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/424-114-0x0000000000000000-mapping.dmp

Download
memory/1044-115-0x0000000000000000-mapping.dmp

Download