f5628f5e31a100bd7f64c47908035d5b9b35f7f375e2a13d25b2370b8500b9ca | Triage™

Resubmissions

07/03/2022, 21:46

220307-1my3aagbh210

28/02/2022, 09:51

220228-lvldtsdhg410

24/02/2022, 19:51

220224-yk4hwaehap1

Analysis

max time kernel
138s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
24/02/2022, 19:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
core.bat
Size 184B
Sample220224-yk4hwaehap
SHA256 5be1931accf2a90e273312b779a873e847ad965e6e11c04e9b83603d4e6e7491
MD5 59aa96fcaa1a3b7331758f7a7ae1f343
SHA1 198ffe332e90207fdb7b97da04770b001c0c5cbf
SHA512 c67253d6d602e150e85e121b2d8d9dedfa72c3ea1950d6a50a8e52a201f06ff9e701acee04b49e682158fb9860c77fd7ad117e20d9c4c8b03938e53e7d6e99c7
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2016	2984	cmd.exe	57
PID 2984 wrote to memory of 2016	2984	cmd.exe	57

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\core.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\strike64.tmp,DllMain /i="license.dat"
  2⤵
  PID:2016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads