Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
12-07-2022 09:34
Static task
static1
Behavioral task
behavioral1
Sample
4b8c42508fc4c4a453819aa3f48fd206984673efe293f4035b09bb739abcf56a.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
4b8c42508fc4c4a453819aa3f48fd206984673efe293f4035b09bb739abcf56a.exe
Resource
win10v2004-20220414-en
General
-
Target
4b8c42508fc4c4a453819aa3f48fd206984673efe293f4035b09bb739abcf56a.exe
-
Size
6.7MB
-
MD5
9eafd2cf5a46061eb25eaf6ca43ce6c7
-
SHA1
167dacf066be94c6914282b86ed8dc4c6f87d139
-
SHA256
4b8c42508fc4c4a453819aa3f48fd206984673efe293f4035b09bb739abcf56a
-
SHA512
59caa8edef67d2148ea32bdebdbae2776c47259554dff33574768f7ea3dd781e3897d0ca99ebe05a29df2670e433ad2d5946ff1239d5cc1a71477d514622f6c1
Malware Config
Signatures
-
Drops startup file 2 IoCs
Processes:
cmd.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchostsw.exe cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchostsw.exe cmd.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
4b8c42508fc4c4a453819aa3f48fd206984673efe293f4035b09bb739abcf56a.exedescription pid process target process PID 1472 wrote to memory of 644 1472 4b8c42508fc4c4a453819aa3f48fd206984673efe293f4035b09bb739abcf56a.exe cmd.exe PID 1472 wrote to memory of 644 1472 4b8c42508fc4c4a453819aa3f48fd206984673efe293f4035b09bb739abcf56a.exe cmd.exe PID 1472 wrote to memory of 644 1472 4b8c42508fc4c4a453819aa3f48fd206984673efe293f4035b09bb739abcf56a.exe cmd.exe PID 1472 wrote to memory of 644 1472 4b8c42508fc4c4a453819aa3f48fd206984673efe293f4035b09bb739abcf56a.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b8c42508fc4c4a453819aa3f48fd206984673efe293f4035b09bb739abcf56a.exe"C:\Users\Admin\AppData\Local\Temp\4b8c42508fc4c4a453819aa3f48fd206984673efe293f4035b09bb739abcf56a.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /Q /C C:\Users\Admin\AppData\Local\Temp/s.bat2⤵
- Drops startup file
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\s.batFilesize
323B
MD5f32530f6af4d31acd2cb2e379174a222
SHA1ce86658ed4fb5fbccd2a9f6ea7884e652618f527
SHA2561f41f345fb9a69f9c70581130386a35fef9722cf541b08e29cada65124adfdab
SHA512802c00fbcb0530e2db90d8b74a65508c8e567632660791bdd3cd5626666c6c8c7a897ba54714388b26c8be46c42239409a8fdad3101c2ebe019ffb23715fef59
-
memory/644-55-0x0000000000000000-mapping.dmp
-
memory/1472-54-0x0000000074F21000-0x0000000074F23000-memory.dmpFilesize
8KB