ta505 | dcf623540207c96fa559e8851828ef277f6bf82f5025fafd6eeac33ed166e10d

Analysis

max time kernel
110s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23/01/2023, 19:48

Target

run.bat
Size

28B
MD5

4a79fe5d9105ae3a9d6a24941b11c78f
SHA1

9ecd4402124806303d981974950c7eb7c531e78f
SHA256

40595e4203fe1f84ee705ebf1b9220bd2815567fce7f1644e8748ff35681ecfd
SHA512

6aef34040fa19971d67d1e7b042319ec072075022fb5aaa4419d76b9ad79992178a5bde564a3b6b7c522b018d0f2c6eb06ce35fe4f006c253246bf025708aed8

Score

10^/10

TA505
Cybercrime group active since 2015, responsible for families like Dridex and Locky.
ta505

Blocklisted process makes network request 2 IoCs

flow	pid	Process
33	2552	rundll32.exe
34	2552	rundll32.exe

Downloads MZ/PE file
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2552	rundll32.exe
2552	rundll32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 3624	1724	cmd.exe	77
PID 1724 wrote to memory of 3624	1724	cmd.exe	77
PID 3624 wrote to memory of 2552	3624	rundll32.exe	78
PID 3624 wrote to memory of 2552	3624	rundll32.exe	78
PID 3624 wrote to memory of 2552	3624	rundll32.exe	78

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\run.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\system32\rundll32.exe
  rundll32.exe 1c220cdc.dat,#2
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3624
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe 1c220cdc.dat,#2
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:2552

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/2552-134-0x0000000003330000-0x000000000334E000-memory.dmp

Filesize
120KB

Download