05596cac3448ed1d0e132c96bd45f02769e08932d4e60be4c918fea9d1064ef7 | Triage

Analysis

max time kernel
30s
max time network
35s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21/04/2023, 17:55

Sharing

Report Analysis Logs

General

Target

ngrok.exe
Size

20.5MB
MD5

0de87b2cb6b4f4c247d7f28b01f3575a
SHA1

336aec3afaf84c8dc897eea14d207c5240d04312
SHA256

05596cac3448ed1d0e132c96bd45f02769e08932d4e60be4c918fea9d1064ef7
SHA512

5e2d4e457b0ab97d899e8ee32c1dfc14ef58f8d7578c6268689b91e7efc4aa56d62038976a1085646e436da9f176135f76a1d6498baa29376731e4f9d3996599
SSDEEP

98304:3dhoPCrdnW86vteEUQvgklCLgvmparWJad9+jdrkow01BFEqEFr9977Fsnj9GmT:3vK/vEE/g/gvAUi2RsnBbT

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
848	ngrok.exe
848	ngrok.exe
1696	ngrok.exe
1696	ngrok.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 1696	848	ngrok.exe	29
PID 848 wrote to memory of 1696	848	ngrok.exe	29
PID 848 wrote to memory of 1696	848	ngrok.exe	29
PID 848 wrote to memory of 564	848	ngrok.exe	30
PID 848 wrote to memory of 564	848	ngrok.exe	30
PID 848 wrote to memory of 564	848	ngrok.exe	30

C:\Users\Admin\AppData\Local\Temp\ngrok.exe
"C:\Users\Admin\AppData\Local\Temp\ngrok.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:848
- C:\Users\Admin\AppData\Local\Temp\ngrok.exe
  C:\Users\Admin\AppData\Local\Temp\ngrok.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1696
- C:\Windows\system32\cmd.exe
  cmd.exe /K
  2⤵
  PID:564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads