e6a2e75a6b2a3f2ac324ed063728d53dd0ff40e24e2abe11a725c41a54aabfe9 | Triage

Resubmissions

11-11-2022 10:35

221111-mm1n8ahd3z 10

11-11-2022 05:40

221111-gcv34ahed6 10

Analysis

max time kernel
91s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2022 05:40

Sharing

Report Analysis Logs

General

Target

belts/sinus.cmd
Size

275B
MD5

fd0220a4dd09b7ae925c622720d1d834
SHA1

380797b2395ac2e4ed98466fb7bd4f0d753097ef
SHA256

0e56587cbdddd1851d2db510d6a539bc325029bc55e66a9d2cd9f011125b12b8
SHA512

d921ca10a3b4ac477580b08921332a22cd626f7cb1130160fec5fec6258fc51d23f0eb49d9a88dbc2865a5116dfb1fe30f162d09ec18e73ef2ccca6ecf25a701

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 4804 wrote to memory of 4108 4804 cmd.exe replace.exe
PID 4804 wrote to memory of 4108 4804 cmd.exe replace.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\belts\sinus.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4804

C:\Windows\system32\replace.exe
replace C:\Windows\\32\\l32.exe C:\Users\Admin\AppData\Local\Temp /A
2⤵
PID:4108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4108-132-0x0000000000000000-mapping.dmp

Download