a5d01b3a74a5b6f948bfdda5d9a4d0fb3e04d68283b63dc88da3cc94a8f5f41c

Analysis

max time kernel
63s
max time network
115s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 05:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a5d01b3a74a5b6f948bfdda5d9a4d0fb3e04d68283b63dc88da3cc94a8f5f41c.exe
Size

366KB
MD5

9771bb805e7b9f614e04597b5f11ff0b
SHA1

2a4dff5700227def465cc6a0f960327405ec386a
SHA256

a5d01b3a74a5b6f948bfdda5d9a4d0fb3e04d68283b63dc88da3cc94a8f5f41c
SHA512

dd71ee88475f9536959cf10ead5c0388f64a25d9203aeed790bfef4e95cb6a395cfb6df860c83e0a6e30228defad1ea28c5178a383eb32a706994204da02157a
SSDEEP

6144:/3UCatEMMEZzcyYWL+hdN+zC9+/sttVjZX5drCRhDnXjt:/0jtciOTtGhDnTt

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1800	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
624	PING.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 1800	1868	a5d01b3a74a5b6f948bfdda5d9a4d0fb3e04d68283b63dc88da3cc94a8f5f41c.exe	31
PID 1868 wrote to memory of 1800	1868	a5d01b3a74a5b6f948bfdda5d9a4d0fb3e04d68283b63dc88da3cc94a8f5f41c.exe	31
PID 1868 wrote to memory of 1800	1868	a5d01b3a74a5b6f948bfdda5d9a4d0fb3e04d68283b63dc88da3cc94a8f5f41c.exe	31
PID 1868 wrote to memory of 1800	1868	a5d01b3a74a5b6f948bfdda5d9a4d0fb3e04d68283b63dc88da3cc94a8f5f41c.exe	31
PID 1800 wrote to memory of 624	1800	cmd.exe	33
PID 1800 wrote to memory of 624	1800	cmd.exe	33
PID 1800 wrote to memory of 624	1800	cmd.exe	33
PID 1800 wrote to memory of 624	1800	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\a5d01b3a74a5b6f948bfdda5d9a4d0fb3e04d68283b63dc88da3cc94a8f5f41c.exe
"C:\Users\Admin\AppData\Local\Temp\a5d01b3a74a5b6f948bfdda5d9a4d0fb3e04d68283b63dc88da3cc94a8f5f41c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\a5d01b3a74a5b6f948bfdda5d9a4d0fb3e04d68283b63dc88da3cc94a8f5f41c.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 3000
    3⤵
    - Runs ping.exe
    PID:624

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1868-54-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1868-55-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/1868-56-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1868-57-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1868-59-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download