b58a31d34c5014ac5f41d7ecd5a741139595ae6d05ac850a41314ff03260e4c0 | Triage

Analysis

max time kernel
130s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12-12-2022 09:01

Sharing

Report Analysis Logs

General

Target

iced/askgothogtan/ginbum.cmd
Size

1KB
MD5

9c5c165f68040c27ca493218e54a57ef
SHA1

e18932c39422969e5908dce3260acae4e46a11ad
SHA256

791ece5a1f7a84eb20786454ec917d3ef16a0a57a7d5e9ecbeb069151cdd16d4
SHA512

fed35aa7628d645d20028d4c106b3899ea459480645a33c720d645dc339637e92033260a0187b33f421b74a5b1df97845bd2d6af833dc4fbfcf4c275937fc638

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 5108 wrote to memory of 4596 5108 cmd.exe xcopy.exe
PID 5108 wrote to memory of 4596 5108 cmd.exe xcopy.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\iced\askgothogtan\ginbum.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:5108

C:\Windows\system32\xcopy.exe
xcopy /s /i /e /h askgothogtan\forbidding.tmp C:\Users\Admin\AppData\Local\Temp\*
2⤵
PID:4596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4596-132-0x0000000000000000-mapping.dmp

Download