daa8802270996f3d7b4835fd9fba42da054ad1a58403854c0f86b0666c631ac1 | Triage

Analysis

max time kernel
79s
max time network
70s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26/11/2022, 11:26

Sharing

Report Analysis Logs

General

Target

107.exe
Size

8KB
MD5

339e4181fe7c160461c885faf5e6fd14
SHA1

b90c1adb7483723b177aca3e423119f5c3803a11
SHA256

403a36221ba0f7f94c0fd180058d033215ec3a0cbbd9cf18dc573ca312dae3a6
SHA512

e3adf3a194b7a7d02b64a0f1e0b5c5315d02f6f501c77cc07a97d5a4a24f200bba5d5080d5205fe8ff6a59e282e0f3946410e548c09f54e0ce277b078d8df662
SSDEEP

96:q2Imfd/26jgx0G60G9kSfkYGol8NDOFs8yoGvhUko9+r5M/24q9eRY0bqOi:q4fdSxK0akSTV4LhNo9w2awOO

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 1476	1364	107.exe	28
PID 1364 wrote to memory of 1476	1364	107.exe	28
PID 1364 wrote to memory of 1476	1364	107.exe	28

C:\Users\Admin\AppData\Local\Temp\107.exe
"C:\Users\Admin\AppData\Local\Temp\107.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 824
  2⤵
  PID:1476

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1364-54-0x000007FEF33C0000-0x000007FEF3DE3000-memory.dmp

Filesize
10.1MB

Download
memory/1476-56-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

Filesize
8KB

Download