24109ee9b860d8db2dd384932b3f802814900c9c09e2c1c6d4eb4e993286874d

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 11:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24109ee9b860d8db2dd384932b3f802814900c9c09e2c1c6d4eb4e993286874d.exe
Size

152KB
MD5

608d743ee23abf03c980627733acff90
SHA1

ab1f2badb1cca0a551dae8cadfb0ea96eba6b944
SHA256

24109ee9b860d8db2dd384932b3f802814900c9c09e2c1c6d4eb4e993286874d
SHA512

04a92f4b38e81e43080c11e9364c81cade23ada371ec030df84366377bf1085b2046fbbaf8a878a95db52c732add96d452376edf12c6a80fc5c0901fc90f2018
SSDEEP

3072:JEh6PDrQJAyFV3lsUwpxrRyJ2Pa6eubAG/suIzWhXt9LVsOStcriuDlQ51QNBufc:JEh6PDrQJAyFV3lsUwpxdyJ2Pa6eubAc

Score

1^/10

Malware Config

Signatures

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
1200	ipconfig.exe
2480	ipconfig.exe
2516	ipconfig.exe
3624	ipconfig.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 5000	4228	24109ee9b860d8db2dd384932b3f802814900c9c09e2c1c6d4eb4e993286874d.exe	82
PID 4228 wrote to memory of 5000	4228	24109ee9b860d8db2dd384932b3f802814900c9c09e2c1c6d4eb4e993286874d.exe	82
PID 4228 wrote to memory of 5000	4228	24109ee9b860d8db2dd384932b3f802814900c9c09e2c1c6d4eb4e993286874d.exe	82
PID 5000 wrote to memory of 1200	5000	cmd.exe	84
PID 5000 wrote to memory of 1200	5000	cmd.exe	84
PID 5000 wrote to memory of 1200	5000	cmd.exe	84
PID 4228 wrote to memory of 2960	4228	24109ee9b860d8db2dd384932b3f802814900c9c09e2c1c6d4eb4e993286874d.exe	95
PID 4228 wrote to memory of 2960	4228	24109ee9b860d8db2dd384932b3f802814900c9c09e2c1c6d4eb4e993286874d.exe	95
PID 4228 wrote to memory of 2960	4228	24109ee9b860d8db2dd384932b3f802814900c9c09e2c1c6d4eb4e993286874d.exe	95
PID 2960 wrote to memory of 2480	2960	cmd.exe	97
PID 2960 wrote to memory of 2480	2960	cmd.exe	97
PID 2960 wrote to memory of 2480	2960	cmd.exe	97
PID 4228 wrote to memory of 4608	4228	24109ee9b860d8db2dd384932b3f802814900c9c09e2c1c6d4eb4e993286874d.exe	111
PID 4228 wrote to memory of 4608	4228	24109ee9b860d8db2dd384932b3f802814900c9c09e2c1c6d4eb4e993286874d.exe	111
PID 4228 wrote to memory of 4608	4228	24109ee9b860d8db2dd384932b3f802814900c9c09e2c1c6d4eb4e993286874d.exe	111
PID 4608 wrote to memory of 2516	4608	cmd.exe	113
PID 4608 wrote to memory of 2516	4608	cmd.exe	113
PID 4608 wrote to memory of 2516	4608	cmd.exe	113
PID 4228 wrote to memory of 1208	4228	24109ee9b860d8db2dd384932b3f802814900c9c09e2c1c6d4eb4e993286874d.exe	114
PID 4228 wrote to memory of 1208	4228	24109ee9b860d8db2dd384932b3f802814900c9c09e2c1c6d4eb4e993286874d.exe	114
PID 4228 wrote to memory of 1208	4228	24109ee9b860d8db2dd384932b3f802814900c9c09e2c1c6d4eb4e993286874d.exe	114
PID 1208 wrote to memory of 3624	1208	cmd.exe	116
PID 1208 wrote to memory of 3624	1208	cmd.exe	116
PID 1208 wrote to memory of 3624	1208	cmd.exe	116

C:\Users\Admin\AppData\Local\Temp\24109ee9b860d8db2dd384932b3f802814900c9c09e2c1c6d4eb4e993286874d.exe
"C:\Users\Admin\AppData\Local\Temp\24109ee9b860d8db2dd384932b3f802814900c9c09e2c1c6d4eb4e993286874d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ipconfig /all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:1200
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ipconfig /all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ipconfig /all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ipconfig /all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:3624

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...