eadaf26df948f0fd541f297e2f0bad435aa4bee5c97e4324ad767dacca77e29d

max time kernel
57s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09/05/2023, 19:14

Sharing

Target

trojan-leaks-main/skidded/FosMeg.exe
Size

6.3MB
MD5

bbf4cdbeb5ca5502e83fb0f33b369039
SHA1

aac536a851b7a778a926a18bd48f7ed49aade999
SHA256

a4a74682c9e1da8f74cf55ba6d6182f8df6e0bc6e8779e326a8b430b7b5072f1
SHA512

054a99338018241620fab8dda716c57b923f1df76a41910495c6293735616fd3fa000958f5148d4016a4b948ca9105be75c48ce7da6d4762c4312563adb477a6
SSDEEP

98304:1nHLaZYRHMqoms1k7sygTN/A55IblUjUM2HaEXwrNqcCmgSJetrVTETuDFofo:1HOcFts1YMTN+yM3glJmgOTzA

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2040	1752	FosMeg.exe	29
PID 1752 wrote to memory of 2040	1752	FosMeg.exe	29
PID 1752 wrote to memory of 2040	1752	FosMeg.exe	29
PID 1752 wrote to memory of 2040	1752	FosMeg.exe	29

C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\skidded\FosMeg.exe
"C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\skidded\FosMeg.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\75CD.tmp\75CE.tmp\75DE.bat C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\skidded\FosMeg.exe"
  2⤵
  PID:2040

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\75CD.tmp\75CE.tmp\75DE.bat

Filesize
494B

MD5
1b234c28d48e926cb5c7a05a71e5d9a7

SHA1
c25b821b5346ac9b4a5344453ede71cc12bdbe60

SHA256
aa10cb4be3b37b44ceb2c9fa8941a76ab2106b2befc50c2e39428628faf3ecf5

SHA512
a8dc8a69ad00c34a2166a2b7041a7b0ef9a5cc32e79466d19406e4c6558fdb9455e1d041fdbaf8e78911d799ce08dd4f806a0244284031e478786aacb34eee18

Download Submit