Analysis

  • max time kernel
    151s
  • max time network
    177s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2022, 14:32

General

  • Target

    5d49eb5359e4dc86b762fd4b5228bcd83294d6b2fe3bd1397134d8f21664cac3.exe

  • Size

    537KB

  • MD5

    76e79232cb0468b68f59ca507b3bec8c

  • SHA1

    0c322f4e98b0e0258eef7f4b58c3e2b9d9a2c76b

  • SHA256

    5d49eb5359e4dc86b762fd4b5228bcd83294d6b2fe3bd1397134d8f21664cac3

  • SHA512

    a0e149d88ff0de8bebf2b6340323b06abad3869df76dd5728ce07c081f45a945baedc04c3535e5a17c38ccabf2b56a1f39e03821c0057ff31eb6a61653e24037

  • SSDEEP

    1536:OKD0A2T3vLbsih9e8bTTpb/IgQmP9zKcTDB4w/UjlQ/dpKRqff:352T3siXei5bcmP9JfUjW

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5d49eb5359e4dc86b762fd4b5228bcd83294d6b2fe3bd1397134d8f21664cac3.exe
    "C:\Users\Admin\AppData\Local\Temp\5d49eb5359e4dc86b762fd4b5228bcd83294d6b2fe3bd1397134d8f21664cac3.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:4968
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\$$$$$.bat
      2⤵
        PID:2204

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • \??\c:\$$$$$.bat

            Filesize

            264B

            MD5

            3bfc087962abfb8d6249eda2915e9c80

            SHA1

            d25ae85bdd7d6b25fdf6f42636cbf45fa734f8d7

            SHA256

            810daddb3540cd883ad9acc5662a7a974a75409b7a9edaa08b5430d591632719

            SHA512

            3ef0389a0e191e3c97db250e80f82b685f6bfc09a57450081a139d78772074024a4bbbd16032dbe807992af17852e5e69a53339eb876e61c61798a803736542c

          • memory/4968-132-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

          • memory/4968-133-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

          • memory/4968-135-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB