05596cac3448ed1d0e132c96bd45f02769e08932d4e60be4c918fea9d1064ef7 | Triage

Analysis

max time kernel
135s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2023, 17:55

Sharing

Report Analysis Logs

General

Target

ngrok.exe
Size

20.5MB
MD5

0de87b2cb6b4f4c247d7f28b01f3575a
SHA1

336aec3afaf84c8dc897eea14d207c5240d04312
SHA256

05596cac3448ed1d0e132c96bd45f02769e08932d4e60be4c918fea9d1064ef7
SHA512

5e2d4e457b0ab97d899e8ee32c1dfc14ef58f8d7578c6268689b91e7efc4aa56d62038976a1085646e436da9f176135f76a1d6498baa29376731e4f9d3996599
SSDEEP

98304:3dhoPCrdnW86vteEUQvgklCLgvmparWJad9+jdrkow01BFEqEFr9977Fsnj9GmT:3vK/vEE/g/gvAUi2RsnBbT

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5044	ngrok.exe
5044	ngrok.exe
5044	ngrok.exe
5044	ngrok.exe
1016	ngrok.exe
1016	ngrok.exe
1016	ngrok.exe
1016	ngrok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 1016	5044	ngrok.exe	86
PID 5044 wrote to memory of 1016	5044	ngrok.exe	86
PID 5044 wrote to memory of 3184	5044	ngrok.exe	87
PID 5044 wrote to memory of 3184	5044	ngrok.exe	87

C:\Users\Admin\AppData\Local\Temp\ngrok.exe
"C:\Users\Admin\AppData\Local\Temp\ngrok.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Users\Admin\AppData\Local\Temp\ngrok.exe
  C:\Users\Admin\AppData\Local\Temp\ngrok.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1016
- C:\Windows\system32\cmd.exe
  cmd.exe /K
  2⤵
  PID:3184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads