Overview
overview
10Static
static
1Desktop/2f...53.exe
windows7-x64
10Desktop/2f...53.exe
windows10-2004-x64
10Desktop/50...92.exe
windows7-x64
1Desktop/50...92.exe
windows10-2004-x64
1Desktop/bb...26.exe
windows7-x64
1Desktop/bb...26.exe
windows10-2004-x64
1Desktop/ed...74.exe
windows7-x64
1Desktop/ed...74.exe
windows10-2004-x64
3Desktop/ff...c8.exe
windows7-x64
1Desktop/ff...c8.exe
windows10-2004-x64
1Analysis
-
max time kernel
135s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 12:54
Static task
static1
Behavioral task
behavioral1
Sample
Desktop/2f0812f7f7905937a82c3a755c40becf63e0d6ed39f212ac931774dfdf338d53.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Desktop/2f0812f7f7905937a82c3a755c40becf63e0d6ed39f212ac931774dfdf338d53.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
Desktop/50135b3cd8e475e98d6e1c9886bb8cd10f400096dfc840f174fc4545fb0a3b92.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
Desktop/50135b3cd8e475e98d6e1c9886bb8cd10f400096dfc840f174fc4545fb0a3b92.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
Desktop/bbbd5d0aef3c2cfa296cee376dea6d7eb777a9c12140aed1a7c2c8d6ecda1e26.exe
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
Desktop/bbbd5d0aef3c2cfa296cee376dea6d7eb777a9c12140aed1a7c2c8d6ecda1e26.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
Desktop/ed902b16d454afd9d3a972e0dbe5d46e5f5b0da01e5e763069f149f07cbaf274.exe
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
Desktop/ed902b16d454afd9d3a972e0dbe5d46e5f5b0da01e5e763069f149f07cbaf274.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
Desktop/ffd5738de2af368a497d3a2020bb51ed380b00f3eb4abefa835c362ec7df8bc8.exe
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
Desktop/ffd5738de2af368a497d3a2020bb51ed380b00f3eb4abefa835c362ec7df8bc8.exe
Resource
win10v2004-20230220-en
General
-
Target
Desktop/50135b3cd8e475e98d6e1c9886bb8cd10f400096dfc840f174fc4545fb0a3b92.exe
-
Size
221KB
-
MD5
812e6a209b063b65661987c557cf9971
-
SHA1
3c0709db8983a91cb32b464fba7ce3af396758c3
-
SHA256
50135b3cd8e475e98d6e1c9886bb8cd10f400096dfc840f174fc4545fb0a3b92
-
SHA512
6173d24eb79796b7a78dc193c62964acc5e8533ce82379854b78f3cd3fdc3b5a3eb255b47493ced7c769c862196fe3e90463c51597f481c43798ee8d5aa96962
-
SSDEEP
3072:hvTiJQepu4he4l6Yjyb453JwmuRljmScpBl9PLa3d+EIeHEjktcv1oKGys85fCp:hiAWOy3JwHRlinBl9PLBgWCp
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
50135b3cd8e475e98d6e1c9886bb8cd10f400096dfc840f174fc4545fb0a3b92.execmd.exedescription pid process target process PID 2820 wrote to memory of 4964 2820 50135b3cd8e475e98d6e1c9886bb8cd10f400096dfc840f174fc4545fb0a3b92.exe cmd.exe PID 2820 wrote to memory of 4964 2820 50135b3cd8e475e98d6e1c9886bb8cd10f400096dfc840f174fc4545fb0a3b92.exe cmd.exe PID 2820 wrote to memory of 4964 2820 50135b3cd8e475e98d6e1c9886bb8cd10f400096dfc840f174fc4545fb0a3b92.exe cmd.exe PID 4964 wrote to memory of 2784 4964 cmd.exe PING.EXE PID 4964 wrote to memory of 2784 4964 cmd.exe PING.EXE PID 4964 wrote to memory of 2784 4964 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\Desktop\50135b3cd8e475e98d6e1c9886bb8cd10f400096dfc840f174fc4545fb0a3b92.exe"C:\Users\Admin\AppData\Local\Temp\Desktop\50135b3cd8e475e98d6e1c9886bb8cd10f400096dfc840f174fc4545fb0a3b92.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping www.baidu.com2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping www.baidu.com3⤵
- Runs ping.exe