86b70df30c283f3d35365699f0061e2db28b883aaae493dafce122fdcdfadb06

Analysis

max time kernel
146s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/09/2022, 10:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86b70df30c283f3d35365699f0061e2db28b883aaae493dafce122fdcdfadb06.exe
Size

7.1MB
MD5

32bdaa7e33fa1d6120549cfac054d06b
SHA1

f579172541393ac9f91cf953651e669984d34698
SHA256

86b70df30c283f3d35365699f0061e2db28b883aaae493dafce122fdcdfadb06
SHA512

1a3fad8c0fd6bebd0f2a7c29fb5e1f01042a736a37dd50cda0e428d5d9b7d6074fa903186b6064d55fb4df71764aac7402c2f3ab46df979e111ea66050af0836
SSDEEP

24576:7mcnH5tkoxFAiKfOLvsyQStlCk6bTTNLp1+Qa0h:7RnHA8Aqag4k8pF

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1524	HSLx264_32EFF.bin

Loads dropped DLL 1 IoCs

pid	Process
1088	86b70df30c283f3d35365699f0061e2db28b883aaae493dafce122fdcdfadb06.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
1056	ping.exe
1632	ping.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 1056	1088	86b70df30c283f3d35365699f0061e2db28b883aaae493dafce122fdcdfadb06.exe	26
PID 1088 wrote to memory of 1056	1088	86b70df30c283f3d35365699f0061e2db28b883aaae493dafce122fdcdfadb06.exe	26
PID 1088 wrote to memory of 1056	1088	86b70df30c283f3d35365699f0061e2db28b883aaae493dafce122fdcdfadb06.exe	26
PID 1088 wrote to memory of 1056	1088	86b70df30c283f3d35365699f0061e2db28b883aaae493dafce122fdcdfadb06.exe	26
PID 1088 wrote to memory of 1524	1088	86b70df30c283f3d35365699f0061e2db28b883aaae493dafce122fdcdfadb06.exe	28
PID 1088 wrote to memory of 1524	1088	86b70df30c283f3d35365699f0061e2db28b883aaae493dafce122fdcdfadb06.exe	28
PID 1088 wrote to memory of 1524	1088	86b70df30c283f3d35365699f0061e2db28b883aaae493dafce122fdcdfadb06.exe	28
PID 1088 wrote to memory of 1524	1088	86b70df30c283f3d35365699f0061e2db28b883aaae493dafce122fdcdfadb06.exe	28
PID 1088 wrote to memory of 1524	1088	86b70df30c283f3d35365699f0061e2db28b883aaae493dafce122fdcdfadb06.exe	28
PID 1088 wrote to memory of 1524	1088	86b70df30c283f3d35365699f0061e2db28b883aaae493dafce122fdcdfadb06.exe	28
PID 1088 wrote to memory of 1524	1088	86b70df30c283f3d35365699f0061e2db28b883aaae493dafce122fdcdfadb06.exe	28
PID 1524 wrote to memory of 1632	1524	HSLx264_32EFF.bin	29
PID 1524 wrote to memory of 1632	1524	HSLx264_32EFF.bin	29
PID 1524 wrote to memory of 1632	1524	HSLx264_32EFF.bin	29
PID 1524 wrote to memory of 1632	1524	HSLx264_32EFF.bin	29

C:\Users\Admin\AppData\Local\Temp\86b70df30c283f3d35365699f0061e2db28b883aaae493dafce122fdcdfadb06.exe
"C:\Users\Admin\AppData\Local\Temp\86b70df30c283f3d35365699f0061e2db28b883aaae493dafce122fdcdfadb06.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\ping.exe
  ping 4.4.8.8
  2⤵
  - Runs ping.exe
  PID:1056
- C:\Users\Admin\AppData\Local\Temp\HSLx264_32EFF.bin
  "C:\Users\Admin\AppData\Local\Temp\\HSLx264_32EFF.bin"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\SysWOW64\ping.exe
    ping -n 20 12.232.4.32
    3⤵
    - Runs ping.exe
    PID:1632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HSLx264_32EFF.bin

Filesize
381KB

MD5
62dfaf43c410edcd4233f6249e9ea801

SHA1
411352e34cf579d63463d2ccfdc485ca9acaaede

SHA256
b0ae66952cfe592df34f2b6d9e50bccd14d05f56f93d188287b4c2069352fca8

SHA512
bc33b2056bbd1866fba74c26fe307de1550dd86aaaa42e255f560303cad980ba79a6f0fbac1fad167323a086e80124686711f2db7cd9e328c659db0bc4b93317

Download Submit
\Users\Admin\AppData\Local\Temp\HSLx264_32EFF.bin

Filesize
381KB

MD5
62dfaf43c410edcd4233f6249e9ea801

SHA1
411352e34cf579d63463d2ccfdc485ca9acaaede

SHA256
b0ae66952cfe592df34f2b6d9e50bccd14d05f56f93d188287b4c2069352fca8

SHA512
bc33b2056bbd1866fba74c26fe307de1550dd86aaaa42e255f560303cad980ba79a6f0fbac1fad167323a086e80124686711f2db7cd9e328c659db0bc4b93317

Download Submit
memory/1524-58-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download