99482cc76a3f020bbca4609e4b4d39e3577543443898941b916079dc9b738fb3 | Triage

Analysis

max time kernel
91s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2022 18:59

Sharing

Report Analysis Logs

General

Target

notrobassfir/colonelclothes.bat
Size

1KB
MD5

ccd8689373558c3bc18aa89994fde940
SHA1

3b82acecef9a9b5c8c3b2343e1082a7a95baedcb
SHA256

9bf48a2dfaa3acdbf45552a1bc73c7679ec754cd0d67b6936cfb88aa6130cb6b
SHA512

a721d9ec1015c3d0558fd7eac4eb23a34877ac5aa0c2d629069a26afcd5eb7a50062a48ccb14dec0790735a4d20f91fe17dce46c02bacd0f30533f9d017e9ae1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 3560	4708	cmd.exe	83
PID 4708 wrote to memory of 3560	4708	cmd.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\notrobassfir\colonelclothes.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Windows\system32\xcopy.exe
  xcopy /s /i /e /h notrobassfir\imposing.dat C:\Users\Admin\AppData\Local\Temp\*
  2⤵
  PID:3560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads