dfe88c225ba76e233c2dced11d32b3cf994466692dd8ab85be655907231e8acb

Analysis

max time kernel
169s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 15:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GO1.bat
Size

686B
MD5

f12a54ae1b6d9cd13308ae482de0740b
SHA1

e4c724dc0a15b9df9ff5f8ff7791bab09c7b7a52
SHA256

fee8839f9603e47e8da81324c3b35c0966b0b0acb93a7d8962573308abb3be45
SHA512

c877089099680fde6f4793b4cddf93c3f0a43269f2cb42deaab88777b25bccfe39c0fb6667690fd67dd637418df76e15ff0d1ea8e28d300c953967602f95a040

Score

1^/10

Malware Config

Signatures

Runs ping.exe 1 TTPs 64 IoCs

Remote System Discovery

T1018

pid	Process
4672	PING.EXE
3408	PING.EXE
216	PING.EXE
3392	PING.EXE
840	PING.EXE
3944	PING.EXE
3720	PING.EXE
4144	PING.EXE
2540	PING.EXE
4348	PING.EXE
1632	PING.EXE
1396	PING.EXE
3964	PING.EXE
3008	PING.EXE
3980	PING.EXE
4468	PING.EXE
3644	PING.EXE
4736	PING.EXE
3532	PING.EXE
3960	PING.EXE
3944	PING.EXE
4080	PING.EXE
3120	PING.EXE
3636	PING.EXE
3572	PING.EXE
3184	PING.EXE
3852	PING.EXE
2064	PING.EXE
4436	PING.EXE
640	PING.EXE
1864	PING.EXE
1748	PING.EXE
1568	PING.EXE
2316	PING.EXE
4852	PING.EXE
3120	PING.EXE
2176	PING.EXE
2208	PING.EXE
1860	PING.EXE
216	PING.EXE
3824	PING.EXE
1864	PING.EXE
2452	PING.EXE
1412	PING.EXE
4784	PING.EXE
3660	PING.EXE
1312	PING.EXE
4624	PING.EXE
260	PING.EXE
4968	PING.EXE
3676	PING.EXE
4264	PING.EXE
2568	PING.EXE
4900	PING.EXE
1360	PING.EXE
640	PING.EXE
2624	PING.EXE
832	PING.EXE
820	PING.EXE
2328	PING.EXE
4848	PING.EXE
2220	PING.EXE
1816	PING.EXE
2512	PING.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 776	924	cmd.exe	80
PID 924 wrote to memory of 776	924	cmd.exe	80
PID 924 wrote to memory of 2568	924	cmd.exe	81
PID 924 wrote to memory of 2568	924	cmd.exe	81
PID 924 wrote to memory of 4492	924	cmd.exe	82
PID 924 wrote to memory of 4492	924	cmd.exe	82
PID 924 wrote to memory of 3256	924	cmd.exe	83
PID 924 wrote to memory of 3256	924	cmd.exe	83
PID 924 wrote to memory of 3408	924	cmd.exe	84
PID 924 wrote to memory of 3408	924	cmd.exe	84
PID 924 wrote to memory of 2540	924	cmd.exe	85
PID 924 wrote to memory of 2540	924	cmd.exe	85
PID 924 wrote to memory of 3120	924	cmd.exe	86
PID 924 wrote to memory of 3120	924	cmd.exe	86
PID 924 wrote to memory of 4992	924	cmd.exe	87
PID 924 wrote to memory of 4992	924	cmd.exe	87
PID 924 wrote to memory of 4968	924	cmd.exe	88
PID 924 wrote to memory of 4968	924	cmd.exe	88
PID 924 wrote to memory of 4856	924	cmd.exe	89
PID 924 wrote to memory of 4856	924	cmd.exe	89
PID 924 wrote to memory of 1412	924	cmd.exe	91
PID 924 wrote to memory of 1412	924	cmd.exe	91
PID 924 wrote to memory of 4324	924	cmd.exe	92
PID 924 wrote to memory of 4324	924	cmd.exe	92
PID 924 wrote to memory of 3404	924	cmd.exe	93
PID 924 wrote to memory of 3404	924	cmd.exe	93
PID 924 wrote to memory of 2328	924	cmd.exe	94
PID 924 wrote to memory of 2328	924	cmd.exe	94
PID 924 wrote to memory of 2196	924	cmd.exe	95
PID 924 wrote to memory of 2196	924	cmd.exe	95
PID 924 wrote to memory of 2176	924	cmd.exe	96
PID 924 wrote to memory of 2176	924	cmd.exe	96
PID 924 wrote to memory of 4660	924	cmd.exe	97
PID 924 wrote to memory of 4660	924	cmd.exe	97
PID 924 wrote to memory of 1480	924	cmd.exe	98
PID 924 wrote to memory of 1480	924	cmd.exe	98
PID 924 wrote to memory of 216	924	cmd.exe	99
PID 924 wrote to memory of 216	924	cmd.exe	99
PID 924 wrote to memory of 1848	924	cmd.exe	100
PID 924 wrote to memory of 1848	924	cmd.exe	100
PID 924 wrote to memory of 2736	924	cmd.exe	101
PID 924 wrote to memory of 2736	924	cmd.exe	101
PID 924 wrote to memory of 1864	924	cmd.exe	102
PID 924 wrote to memory of 1864	924	cmd.exe	102
PID 924 wrote to memory of 4460	924	cmd.exe	103
PID 924 wrote to memory of 4460	924	cmd.exe	103
PID 924 wrote to memory of 2624	924	cmd.exe	104
PID 924 wrote to memory of 2624	924	cmd.exe	104
PID 924 wrote to memory of 3904	924	cmd.exe	105
PID 924 wrote to memory of 3904	924	cmd.exe	105
PID 924 wrote to memory of 4624	924	cmd.exe	106
PID 924 wrote to memory of 4624	924	cmd.exe	106
PID 924 wrote to memory of 2756	924	cmd.exe	107
PID 924 wrote to memory of 2756	924	cmd.exe	107
PID 924 wrote to memory of 4296	924	cmd.exe	108
PID 924 wrote to memory of 4296	924	cmd.exe	108
PID 924 wrote to memory of 3008	924	cmd.exe	109
PID 924 wrote to memory of 3008	924	cmd.exe	109
PID 924 wrote to memory of 2604	924	cmd.exe	110
PID 924 wrote to memory of 2604	924	cmd.exe	110
PID 924 wrote to memory of 3396	924	cmd.exe	111
PID 924 wrote to memory of 3396	924	cmd.exe	111
PID 924 wrote to memory of 3392	924	cmd.exe	112
PID 924 wrote to memory of 3392	924	cmd.exe	112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\GO1.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:924
- C:\Windows\system32\mode.com
  MODE con: COLS=40 lines=15
  2⤵
  PID:776
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:2568
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:4492
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:3256
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:3408
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:2540
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:3120
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:4992
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:4968
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:4856
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:1412
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:4324
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:3404
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:2328
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:2196
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:2176
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:4660
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:1480
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:216
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:1848
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:2736
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:1864
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:4460
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:2624
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:3904
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:4624
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:2756
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:4296
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:3008
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:2604
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:3396
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:3392
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:3676
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:3636
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:2864
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:4348
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:1408
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:1336
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:1788
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:1056
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:2208
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:4736
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:832
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:4436
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:60
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:4344
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:4688
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:3796
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:4244
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:1632
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:840
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:2316
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:1052
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:4264
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:2452
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:1860
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:3532
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:4848
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:3980
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:2760
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:3948
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:3944
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:2568
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:3496
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:1396
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:3420
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:3184
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:8
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:4952
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:4968
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:3720
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:4856
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:1468
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:640
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:1356
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:2176
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:4468
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:3296
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:216
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:4900
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:3824
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:3852
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:1864
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:4192
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:3644
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:3896
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:3092
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:4624
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:820
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:2476
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:4784
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:2220
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:1588
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:1592
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:3572
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:3964
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:3816
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:4180
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:4548
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:2440
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:1816
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:2388
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:4744
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:1832
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:1360
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:3960
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:3776
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:4852
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:5052
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:1748
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:2480
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:3660
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:2368
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:996
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:2684
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:4708
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:3884
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:4164
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:4328
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:4208
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:3376
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:3944
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:2512
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:3496
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:1396
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:1568
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:3504
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:3120
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:4896
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:1312
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:2064
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:1368
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:4196
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:2252
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:640
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:1356
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:2176
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:4468
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:4144
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:260
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:4080
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:1176
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  - Runs ping.exe
  PID:4672
- C:\Windows\system32\PING.EXE
  ping -n 2 localhost
  2⤵
  PID:4184

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads