5517f176fbd908ab99f0afe8980ce9e118cf89ba982dde9d403f47e9c5f4a8b8 | Triage

Analysis

max time kernel
150s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2022 06:46

Sharing

Report Analysis Logs

General

Target

TE04/syndrome/dracula.cmd
Size

308B
MD5

7f099ddafbff736bfda8eef8365f20ce
SHA1

6474123573496ae56747e8df01b21fe00043289b
SHA256

05cf835776fba30791b155a9bdfdb3bc245d3283bf6b844838a8a6938c94aec7
SHA512

2a356d3286f32ffdb025b81f871ffef87f65433ed60cced557921a634f9fd1b7fd0ffa05bec9ed46e9ebb000a34c0f69be6954e4ca9f849ca291a5f8c5b181f6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 3436 wrote to memory of 4268 3436 cmd.exe replace.exe
PID 3436 wrote to memory of 4268 3436 cmd.exe replace.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\TE04\syndrome\dracula.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3436

C:\Windows\system32\replace.exe
replace C:\Windows\\32\\r32.exe C:\Users\Admin\AppData\Local\Temp /A
2⤵
PID:4268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4268-132-0x0000000000000000-mapping.dmp

Download