09eeb778d2b787fb4a329923ce022d54c8b980213698d74487913700e40b5f1e

Resubmissions

14/01/2025, 06:33

250114-hbk26s1rem 10

14/01/2025, 06:12

250114-gyapaa1mfq 10

19/06/2022, 16:53

220619-vdyr9sfcgl 10

Analysis

max time kernel
147s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
19/06/2022, 16:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AmongusHack.exe
Size

202KB
MD5

5c39bb532bd116ae2c9e47528c9f81f3
SHA1

4af704758e4d281997df43811fcd759e4b3ea755
SHA256

09eeb778d2b787fb4a329923ce022d54c8b980213698d74487913700e40b5f1e
SHA512

18cd104f1d9ec1c6b52f0461d9cbba4483bad21074805e0e8c425045d77e439e795b19953964abc791f7b17dc7247d4481c2e4e6083019e8e5b4ca704682d320

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1348	1948	AmongusHack.exe	28
PID 1948 wrote to memory of 1348	1948	AmongusHack.exe	28
PID 1948 wrote to memory of 1348	1948	AmongusHack.exe	28
PID 1948 wrote to memory of 1348	1948	AmongusHack.exe	28
PID 1348 wrote to memory of 1184	1348	AmongusHack.exe	29
PID 1348 wrote to memory of 1184	1348	AmongusHack.exe	29
PID 1348 wrote to memory of 1184	1348	AmongusHack.exe	29
PID 1348 wrote to memory of 1184	1348	AmongusHack.exe	29
PID 1184 wrote to memory of 1368	1184	AmongusHack.exe	30
PID 1184 wrote to memory of 1368	1184	AmongusHack.exe	30
PID 1184 wrote to memory of 1368	1184	AmongusHack.exe	30
PID 1184 wrote to memory of 1368	1184	AmongusHack.exe	30
PID 1368 wrote to memory of 1352	1368	AmongusHack.exe	31
PID 1368 wrote to memory of 1352	1368	AmongusHack.exe	31
PID 1368 wrote to memory of 1352	1368	AmongusHack.exe	31
PID 1368 wrote to memory of 1352	1368	AmongusHack.exe	31
PID 1352 wrote to memory of 804	1352	AmongusHack.exe	32
PID 1352 wrote to memory of 804	1352	AmongusHack.exe	32
PID 1352 wrote to memory of 804	1352	AmongusHack.exe	32
PID 1352 wrote to memory of 804	1352	AmongusHack.exe	32
PID 804 wrote to memory of 1504	804	AmongusHack.exe	33
PID 804 wrote to memory of 1504	804	AmongusHack.exe	33
PID 804 wrote to memory of 1504	804	AmongusHack.exe	33
PID 804 wrote to memory of 1504	804	AmongusHack.exe	33
PID 1504 wrote to memory of 1380	1504	AmongusHack.exe	34
PID 1504 wrote to memory of 1380	1504	AmongusHack.exe	34
PID 1504 wrote to memory of 1380	1504	AmongusHack.exe	34
PID 1504 wrote to memory of 1380	1504	AmongusHack.exe	34
PID 1380 wrote to memory of 1616	1380	AmongusHack.exe	35
PID 1380 wrote to memory of 1616	1380	AmongusHack.exe	35
PID 1380 wrote to memory of 1616	1380	AmongusHack.exe	35
PID 1380 wrote to memory of 1616	1380	AmongusHack.exe	35
PID 1616 wrote to memory of 1604	1616	AmongusHack.exe	36
PID 1616 wrote to memory of 1604	1616	AmongusHack.exe	36
PID 1616 wrote to memory of 1604	1616	AmongusHack.exe	36
PID 1616 wrote to memory of 1604	1616	AmongusHack.exe	36
PID 1224 wrote to memory of 1160	1224	AmongusHack.exe	38
PID 1224 wrote to memory of 1160	1224	AmongusHack.exe	38
PID 1224 wrote to memory of 1160	1224	AmongusHack.exe	38
PID 1224 wrote to memory of 1160	1224	AmongusHack.exe	38
PID 1160 wrote to memory of 1620	1160	AmongusHack.exe	39
PID 1160 wrote to memory of 1620	1160	AmongusHack.exe	39
PID 1160 wrote to memory of 1620	1160	AmongusHack.exe	39
PID 1160 wrote to memory of 1620	1160	AmongusHack.exe	39
PID 1620 wrote to memory of 1568	1620	AmongusHack.exe	40
PID 1620 wrote to memory of 1568	1620	AmongusHack.exe	40
PID 1620 wrote to memory of 1568	1620	AmongusHack.exe	40
PID 1620 wrote to memory of 1568	1620	AmongusHack.exe	40
PID 1568 wrote to memory of 1436	1568	AmongusHack.exe	41
PID 1568 wrote to memory of 1436	1568	AmongusHack.exe	41
PID 1568 wrote to memory of 1436	1568	AmongusHack.exe	41
PID 1568 wrote to memory of 1436	1568	AmongusHack.exe	41
PID 1436 wrote to memory of 1196	1436	AmongusHack.exe	42
PID 1436 wrote to memory of 1196	1436	AmongusHack.exe	42
PID 1436 wrote to memory of 1196	1436	AmongusHack.exe	42
PID 1436 wrote to memory of 1196	1436	AmongusHack.exe	42
PID 1196 wrote to memory of 616	1196	AmongusHack.exe	43
PID 1196 wrote to memory of 616	1196	AmongusHack.exe	43
PID 1196 wrote to memory of 616	1196	AmongusHack.exe	43
PID 1196 wrote to memory of 616	1196	AmongusHack.exe	43
PID 616 wrote to memory of 1880	616	AmongusHack.exe	44
PID 616 wrote to memory of 1880	616	AmongusHack.exe	44
PID 616 wrote to memory of 1880	616	AmongusHack.exe	44
PID 616 wrote to memory of 1880	616	AmongusHack.exe	44

C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
"C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
  "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
    "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1184
  - - C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
      "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1368
    - - C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1352
      - C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:804
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        10⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:616
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        18⤵
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        19⤵
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        20⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        21⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        22⤵
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        23⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        24⤵
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AmongusHack.exe"
        25⤵
        
        PID:1116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/616-118-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/616-115-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/804-78-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/804-75-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/944-123-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/944-126-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1116-147-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1160-95-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1160-98-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1184-66-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1184-63-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1196-114-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1196-111-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1224-91-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1224-94-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1348-59-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1348-62-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1352-74-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1352-71-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1364-138-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1364-135-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1368-143-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1368-146-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1368-70-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1368-67-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1380-86-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1380-83-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1436-110-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1436-107-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1504-79-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1504-82-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1568-106-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1568-103-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1616-89-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1616-87-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1620-99-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1620-102-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1684-134-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1684-131-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1764-142-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1764-139-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1880-122-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1880-119-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1884-127-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1884-130-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1948-54-0x00000000754A1000-0x00000000754A3000-memory.dmp

Filesize
8KB

Download
memory/1948-55-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download
memory/1948-58-0x0000000074880000-0x0000000074E2B000-memory.dmp

Filesize
5.7MB

Download