4ef27aa805d70d310dd56575525553be1baf7a48d4e7327f056ca0a5859c6ff6

Resubmissions

28/10/2021, 13:03

211028-qal7vagdcj10

23/09/2021, 21:49

210923-1pcbasfcar6

Analysis

max time kernel
77s
max time network
152s
platform
windows10_x64
resource
win10v20210408
submitted
23/09/2021, 21:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4ef27aa805d70d310dd56575525553be1baf7a48d4e7327f056ca0a5859c6ff6.dll
Size 115KB
Sample210923-1pcbasfcar
SHA256 4ef27aa805d70d310dd56575525553be1baf7a48d4e7327f056ca0a5859c6ff6
MD5 b28aa40baaf219c8b02afa92bc03010f
SHA1 ce3dd7f9fe5e4fb95b68a09f0edac91c52e51b00
SHA512 3128e4902aa5dac607ece489115b64c950643d9c7308de1b91b0711a175091563d2bbe434eb49dc0d92fdc8c162e4e0adb952962b87a9b1c5a385ff3a8b7562d
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3916	PING.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 1788	644	rundll32.exe	75
PID 644 wrote to memory of 1788	644	rundll32.exe	75
PID 1788 wrote to memory of 3916	1788	cmd.exe	77
PID 1788 wrote to memory of 3916	1788	cmd.exe	77
PID 1788 wrote to memory of 3628	1788	cmd.exe	78
PID 1788 wrote to memory of 3628	1788	cmd.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ef27aa805d70d310dd56575525553be1baf7a48d4e7327f056ca0a5859c6ff6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:644
- C:\Windows\system32\cmd.exe
  cmd /c ping 192.0.2.141 -n 9 -4 -w 1000 > NUL & "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\4ef27aa805d70d310dd56575525553be1baf7a48d4e7327f056ca0a5859c6ff6.dll", #1 oeywkbwt kjzrgqwu & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\system32\PING.EXE
    ping 192.0.2.141 -n 9 -4 -w 1000
    3⤵
    - Runs ping.exe
    PID:3916
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\4ef27aa805d70d310dd56575525553be1baf7a48d4e7327f056ca0a5859c6ff6.dll", #1 oeywkbwt kjzrgqwu
    3⤵
    PID:3628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/644-114-0x000001BFB7940000-0x000001BFB795F000-memory.dmp

Download

memory/3628-118-0x000001D3F06C0000-0x000001D3F06DF000-memory.dmp