24109ee9b860d8db2dd384932b3f802814900c9c09e2c1c6d4eb4e993286874d

Analysis

max time kernel
143s
max time network
163s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 11:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24109ee9b860d8db2dd384932b3f802814900c9c09e2c1c6d4eb4e993286874d.exe
Size

152KB
MD5

608d743ee23abf03c980627733acff90
SHA1

ab1f2badb1cca0a551dae8cadfb0ea96eba6b944
SHA256

24109ee9b860d8db2dd384932b3f802814900c9c09e2c1c6d4eb4e993286874d
SHA512

04a92f4b38e81e43080c11e9364c81cade23ada371ec030df84366377bf1085b2046fbbaf8a878a95db52c732add96d452376edf12c6a80fc5c0901fc90f2018
SSDEEP

3072:JEh6PDrQJAyFV3lsUwpxrRyJ2Pa6eubAG/suIzWhXt9LVsOStcriuDlQ51QNBufc:JEh6PDrQJAyFV3lsUwpxdyJ2Pa6eubAc

Score

1^/10

Malware Config

Signatures

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
2036	ipconfig.exe
1832	ipconfig.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 1996	836	24109ee9b860d8db2dd384932b3f802814900c9c09e2c1c6d4eb4e993286874d.exe	27
PID 836 wrote to memory of 1996	836	24109ee9b860d8db2dd384932b3f802814900c9c09e2c1c6d4eb4e993286874d.exe	27
PID 836 wrote to memory of 1996	836	24109ee9b860d8db2dd384932b3f802814900c9c09e2c1c6d4eb4e993286874d.exe	27
PID 836 wrote to memory of 1996	836	24109ee9b860d8db2dd384932b3f802814900c9c09e2c1c6d4eb4e993286874d.exe	27
PID 1996 wrote to memory of 2036	1996	cmd.exe	29
PID 1996 wrote to memory of 2036	1996	cmd.exe	29
PID 1996 wrote to memory of 2036	1996	cmd.exe	29
PID 1996 wrote to memory of 2036	1996	cmd.exe	29
PID 836 wrote to memory of 1196	836	24109ee9b860d8db2dd384932b3f802814900c9c09e2c1c6d4eb4e993286874d.exe	32
PID 836 wrote to memory of 1196	836	24109ee9b860d8db2dd384932b3f802814900c9c09e2c1c6d4eb4e993286874d.exe	32
PID 836 wrote to memory of 1196	836	24109ee9b860d8db2dd384932b3f802814900c9c09e2c1c6d4eb4e993286874d.exe	32
PID 836 wrote to memory of 1196	836	24109ee9b860d8db2dd384932b3f802814900c9c09e2c1c6d4eb4e993286874d.exe	32
PID 1196 wrote to memory of 1832	1196	cmd.exe	34
PID 1196 wrote to memory of 1832	1196	cmd.exe	34
PID 1196 wrote to memory of 1832	1196	cmd.exe	34
PID 1196 wrote to memory of 1832	1196	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\24109ee9b860d8db2dd384932b3f802814900c9c09e2c1c6d4eb4e993286874d.exe
"C:\Users\Admin\AppData\Local\Temp\24109ee9b860d8db2dd384932b3f802814900c9c09e2c1c6d4eb4e993286874d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ipconfig /all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ipconfig /all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:1832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2036-56-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download