1d5d84f3adc8a2a12fb1dbf4f089c8b1f93627c6658507c7c01c1dbb0d2a4590 | Triage

Analysis

max time kernel
90s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
07-06-2022 03:50

Sharing

Report Analysis Logs

General

Target

1d5d84f3adc8a2a12fb1dbf4f089c8b1f93627c6658507c7c01c1dbb0d2a4590.exe
Size

65KB
MD5

e663478c2a5e06949651931a34f2d14d
SHA1

3ba47f930d7c3018ee06c258e150725434d8d47d
SHA256

1d5d84f3adc8a2a12fb1dbf4f089c8b1f93627c6658507c7c01c1dbb0d2a4590
SHA512

f675f59dcf2bc7206b5168145f2d0d5894380b97c827f013027df50b96ebd4e3d678862c48b428664ef4a3939a0cb5ed54fc8c44fd743847c0f07c90b7ada172

Score

1^/10

Malware Config

Signatures

Runs net.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

1d5d84f3adc8a2a12fb1dbf4f089c8b1f93627c6658507c7c01c1dbb0d2a4590.exenet.exe

description	pid	process	target process
PID 3196 wrote to memory of 4636	3196	1d5d84f3adc8a2a12fb1dbf4f089c8b1f93627c6658507c7c01c1dbb0d2a4590.exe	net.exe
PID 3196 wrote to memory of 4636	3196	1d5d84f3adc8a2a12fb1dbf4f089c8b1f93627c6658507c7c01c1dbb0d2a4590.exe	net.exe
PID 3196 wrote to memory of 4636	3196	1d5d84f3adc8a2a12fb1dbf4f089c8b1f93627c6658507c7c01c1dbb0d2a4590.exe	net.exe
PID 4636 wrote to memory of 1664	4636	net.exe	net1.exe
PID 4636 wrote to memory of 1664	4636	net.exe	net1.exe
PID 4636 wrote to memory of 1664	4636	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\1d5d84f3adc8a2a12fb1dbf4f089c8b1f93627c6658507c7c01c1dbb0d2a4590.exe
"C:\Users\Admin\AppData\Local\Temp\1d5d84f3adc8a2a12fb1dbf4f089c8b1f93627c6658507c7c01c1dbb0d2a4590.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3196

C:\Windows\SysWOW64\net.exe
net user Malware430 infected /ADD
2⤵
- Suspicious use of WriteProcessMemory
PID:4636

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user Malware430 infected /ADD
3⤵
PID:1664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1664-131-0x0000000000000000-mapping.dmp

Download
memory/4636-130-0x0000000000000000-mapping.dmp

Download