541825cb652606c2ea12fd25a842a8b3456d025841c3a7f563655ef77bb67219 | Triage™

Analysis

max time kernel
51s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
15/07/2022, 09:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
541825cb652606c2ea12fd25a842a8b3456d025841c3a7f563655ef77bb67219.bin.exe
Size 6.3MB
Sample220715-kyb4wsabd2
SHA256 541825cb652606c2ea12fd25a842a8b3456d025841c3a7f563655ef77bb67219
MD5 aa4e99b717bcb7e916148a469e69788a
SHA1 42fc554d8442a78a48dc624d3de59ae4515eed6d
SHA512 c6127eb47a24df060e8d81f95dd3fd4d0118b6fefbd38b25e6f23ac11f4ebdd0eecb61ddd79ef0cc9c4e52cdd36e823f99d5be389141f5ac9cead1b95d33f4ca
MD5 SHA1 SHA512

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	541825cb652606c2ea12fd25a842a8b3456d025841c3a7f563655ef77bb67219.bin.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	541825cb652606c2ea12fd25a842a8b3456d025841c3a7f563655ef77bb67219.bin.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	541825cb652606c2ea12fd25a842a8b3456d025841c3a7f563655ef77bb67219.bin.exe

Runs net.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 848	4740	541825cb652606c2ea12fd25a842a8b3456d025841c3a7f563655ef77bb67219.bin.exe	87
PID 4740 wrote to memory of 848	4740	541825cb652606c2ea12fd25a842a8b3456d025841c3a7f563655ef77bb67219.bin.exe	87
PID 848 wrote to memory of 4824	848	cmd.exe	88
PID 848 wrote to memory of 4824	848	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\541825cb652606c2ea12fd25a842a8b3456d025841c3a7f563655ef77bb67219.bin.exe
"C:\Users\Admin\AppData\Local\Temp\541825cb652606c2ea12fd25a842a8b3456d025841c3a7f563655ef77bb67219.bin.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\system32\cmd.exe
  cmd /C "net use \\10.10.3.42\c$ 23AS32df21 /user:adm-karsair"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:848
- - C:\Windows\system32\net.exe
    net use \\10.10.3.42\c$ 23AS32df21 /user:adm-karsair
    3⤵
    PID:4824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads