1a93af2eb20f1aceee61c7baa5be814b7f8be06cae142de892a33e11ba5cfabc

Analysis

max time kernel
47s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 11:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3550/2223.cmd
Size

246B
MD5

9c22b90c930b87357b6bec7d1da0ab51
SHA1

419a740536a9c8062b9beaaced0f0b78931da401
SHA256

a4aabd4d31d0608cc9b535b0722d8214ae235caadd150558c65d5be839e038dd
SHA512

1c01c24243c1597fd26cfe321240f00ac54be854acbc9765e75ae5f9808dfd6bf3f2d3327e5533caa85cfca3976e03480fae19979248aaf1ebf1db6a825f2de9

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2012	in.exe
1380	Process not Found

Loads dropped DLL 1 IoCs

pid	Process
1732	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1744	PING.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1744	1732	cmd.exe	28
PID 1732 wrote to memory of 1744	1732	cmd.exe	28
PID 1732 wrote to memory of 1744	1732	cmd.exe	28
PID 1732 wrote to memory of 2012	1732	cmd.exe	29
PID 1732 wrote to memory of 2012	1732	cmd.exe	29
PID 1732 wrote to memory of 2012	1732	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\3550\2223.cmd"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\system32\PING.EXE
  ping google.com
  2⤵
  - Runs ping.exe
  PID:1744
- C:\Users\Admin\AppData\Local\Temp\in.exe
  C:\Users\Admin\AppData\Local\Temp\\in.exe 3550\upgraded.dat
  2⤵
  - Executes dropped EXE
  PID:2012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\in.exe

Filesize
19KB

MD5
59bce9f07985f8a4204f4d6554cff708

SHA1
645c424974fbe5fe7a04cac73f1c23c96e1570b8

SHA256
ca24aef558647274d019dfb4d7fd1506d84ec278795c30ba53b81bb36130dc57

SHA512
3cf5825a9c7fb80ea0bd36775a92d07f34cd3709ed2c7c8f500f1c8baa5242768f6d575bd2477b77e3f177e7a4994d5c5bddb24c6eb43b60a6bd83ea026a8198

Download Submit
\Users\Admin\AppData\Local\Temp\in.exe

Filesize
19KB

MD5
59bce9f07985f8a4204f4d6554cff708

SHA1
645c424974fbe5fe7a04cac73f1c23c96e1570b8

SHA256
ca24aef558647274d019dfb4d7fd1506d84ec278795c30ba53b81bb36130dc57

SHA512
3cf5825a9c7fb80ea0bd36775a92d07f34cd3709ed2c7c8f500f1c8baa5242768f6d575bd2477b77e3f177e7a4994d5c5bddb24c6eb43b60a6bd83ea026a8198

Download Submit
\Users\Admin\AppData\Local\Temp\in.exe

Filesize
19KB

MD5
59bce9f07985f8a4204f4d6554cff708

SHA1
645c424974fbe5fe7a04cac73f1c23c96e1570b8

SHA256
ca24aef558647274d019dfb4d7fd1506d84ec278795c30ba53b81bb36130dc57

SHA512
3cf5825a9c7fb80ea0bd36775a92d07f34cd3709ed2c7c8f500f1c8baa5242768f6d575bd2477b77e3f177e7a4994d5c5bddb24c6eb43b60a6bd83ea026a8198

Download Submit
memory/2012-58-0x000007FEFBF41000-0x000007FEFBF43000-memory.dmp

Filesize
8KB

Download