ac738b061845ca506d186c7749080cdbf443f859e2b551dd0402474b2604b249 | Triage

Resubmissions

22-12-2022 16:52

221222-vdqrnaaa2s 10

08-12-2022 06:58

221208-hrtdgscb7z 10

Analysis

max time kernel
38s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2022 06:58

Sharing

Report Analysis Logs

General

Target

mollusks/countersink.cmd
Size

334B
MD5

9d6b53c58320a436a8cba81ed2b36578
SHA1

2b9d3193b70cac52897aef536257f52cf268c47f
SHA256

19c18ff61c211c419b5bcacfed5b1f8b0dcf9ea4629f1f42c7c96fe791724342
SHA512

3f7f9ac263947eb287abe2f3698a5d109cb77ea3f52a545a8984257ed2ad0f38d2a92a799522166f1b78eccc724db91d3f0864184634937f66eeb110dfbc3296

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 2680 wrote to memory of 4208 2680 cmd.exe replace.exe
PID 2680 wrote to memory of 4208 2680 cmd.exe replace.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\mollusks\countersink.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2680

C:\Windows\system32\replace.exe
replace C:\Windows\\32\\r32.exe C:\Users\Admin\AppData\Local\Temp /A
2⤵
PID:4208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4208-132-0x0000000000000000-mapping.dmp

Download