eadaf26df948f0fd541f297e2f0bad435aa4bee5c97e4324ad767dacca77e29d

max time kernel
115s
max time network
181s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
09-05-2023 19:14

Sharing

Target

trojan-leaks-main/skidded/Murderer.exe
Size

21.9MB
MD5

8a27182879ba66cf5d07940b16bbb5a0
SHA1

0242ca81d92cd4ece24bc0f558a269f0baeaa8e2
SHA256

887889b8c147adec683a3d5dfa36bae2693b438b27b9b623aea7f16522174e3b
SHA512

7d68b338f20610b20e4f72104ae0d5b1abdc82821c606e03e8b2ae307b13ed010acef8eeba4cb1b5eda61ad324b4ff28a84870cc6901bc328ee519e4646432fe
SSDEEP

393216:WMT+rfHZlgMMH2RhoAZbBQbCVC9woa4KVbh6wHW8ALe4Lfj16ouWcXD:WZZaMi2R7BQbCVC9wioswHW8AvLZ6ouf

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

Murderer.exe

description pid process target process

PID 4248 wrote to memory of 4276 4248 Murderer.exe cmd.exe
PID 4248 wrote to memory of 4276 4248 Murderer.exe cmd.exe

description	pid	process	target process
PID 4248 wrote to memory of 4276	4248	Murderer.exe	cmd.exe
PID 4248 wrote to memory of 4276	4248	Murderer.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\skidded\Murderer.exe
"C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\skidded\Murderer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\System32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\E2C3.tmp\E2C4.tmp\E2C5.bat C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\skidded\Murderer.exe"
  2⤵
  PID:4276

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\E2C3.tmp\E2C4.tmp\E2C5.bat

Filesize
619B

MD5
44148f40b305d441d7d685e42cab976c

SHA1
de1767b8a6361650932a8c3972cd0fb6fd15416b

SHA256
354bcbc57c1e31d2003d80e6c1746a5de844e1b31df9c8b1607ecdeaec18b6f2

SHA512
8d2ce47b972724bacb59e5f65d694d2fe8c64a91df1905e16044b2084e5be6c366bb3fdcffb862ffb21acb01dddf9a53c3fbdb37837aeb70c39f70856c67bee7

Download Submit