119cbe0c3fb3b91c94ce2272cef2a05756cbaceb19dadbde9da4989497f6d42d | Triage

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11-09-2022 11:25

Sharing

Report Analysis Logs

General

Target

FREEBOBUXobfusc.bat
Size

137KB
MD5

c2a24b9d455e27f6d591f47109a2e9f7
SHA1

18c7f234574d342e81ed9970db52141db38c15b7
SHA256

119cbe0c3fb3b91c94ce2272cef2a05756cbaceb19dadbde9da4989497f6d42d
SHA512

7ed16c003aabff67d9027ef4f9c9f909948b650bc4a8d086a53c712b76923b5c381218df8c6a50cf009163c249b29099ed88e5c667f7ce7df7ba89348f31ef8f
SSDEEP

3072:xOnGVvl5zF5DN1VnNAW5Z23oONqWk8ZgqU1AJK2W0H:zDV5v+oO04w1AJK30H

Score

1^/10

Malware Config

Signatures

Runs net.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 1692	1456	cmd.exe	27
PID 1456 wrote to memory of 1692	1456	cmd.exe	27
PID 1456 wrote to memory of 1692	1456	cmd.exe	27
PID 1692 wrote to memory of 1324	1692	net.exe	28
PID 1692 wrote to memory of 1324	1692	net.exe	28
PID 1692 wrote to memory of 1324	1692	net.exe	28

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\FREEBOBUXobfusc.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:1324

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1324-55-0x0000000000000000-mapping.dmp

Download
memory/1692-54-0x0000000000000000-mapping.dmp

Download