67597b2f06c2fef4c71c99a3932139cc18a443efccea433255746283e3cc5a45

Resubmissions

01/06/2023, 10:29

230601-mjktladg55 1

01/06/2023, 10:28

230601-mh61fadg52 1

01/06/2023, 10:27

230601-mhek7aeb9z 1

Analysis

max time kernel
39s
max time network
39s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2023, 10:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

morsáč.bat
Size

1KB
MD5

4c1d9925cce58ee333d062a3b51e010a
SHA1

9073d20384407b99a6a7447613392760c4b0814b
SHA256

67597b2f06c2fef4c71c99a3932139cc18a443efccea433255746283e3cc5a45
SHA512

e02599d02c879d15bf04fcb20560b2e99ff58b1c0e7be43e81ffcb3ab2f851a396778012c4b22a4bbb6911cfb91e2b965cb5714550f539017ddf6c319f638950

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 4116	552	cmd.exe	87
PID 552 wrote to memory of 4116	552	cmd.exe	87
PID 4116 wrote to memory of 4204	4116	cmd.exe	88
PID 4116 wrote to memory of 4204	4116	cmd.exe	88
PID 552 wrote to memory of 1020	552	cmd.exe	89
PID 552 wrote to memory of 1020	552	cmd.exe	89
PID 1020 wrote to memory of 5036	1020	cmd.exe	90
PID 1020 wrote to memory of 5036	1020	cmd.exe	90
PID 552 wrote to memory of 5040	552	cmd.exe	91
PID 552 wrote to memory of 5040	552	cmd.exe	91
PID 5040 wrote to memory of 3480	5040	cmd.exe	92
PID 5040 wrote to memory of 3480	5040	cmd.exe	92
PID 552 wrote to memory of 2672	552	cmd.exe	93
PID 552 wrote to memory of 2672	552	cmd.exe	93
PID 2672 wrote to memory of 1984	2672	cmd.exe	94
PID 2672 wrote to memory of 1984	2672	cmd.exe	94
PID 552 wrote to memory of 2820	552	cmd.exe	95
PID 552 wrote to memory of 2820	552	cmd.exe	95
PID 2820 wrote to memory of 3864	2820	cmd.exe	96
PID 2820 wrote to memory of 3864	2820	cmd.exe	96
PID 552 wrote to memory of 3232	552	cmd.exe	97
PID 552 wrote to memory of 3232	552	cmd.exe	97
PID 3232 wrote to memory of 3992	3232	cmd.exe	98
PID 3232 wrote to memory of 3992	3232	cmd.exe	98
PID 552 wrote to memory of 4828	552	cmd.exe	99
PID 552 wrote to memory of 4828	552	cmd.exe	99
PID 4828 wrote to memory of 1188	4828	cmd.exe	100
PID 4828 wrote to memory of 1188	4828	cmd.exe	100
PID 552 wrote to memory of 2172	552	cmd.exe	101
PID 552 wrote to memory of 2172	552	cmd.exe	101
PID 2172 wrote to memory of 3592	2172	cmd.exe	102
PID 2172 wrote to memory of 3592	2172	cmd.exe	102
PID 552 wrote to memory of 1520	552	cmd.exe	103
PID 552 wrote to memory of 1520	552	cmd.exe	103
PID 1520 wrote to memory of 2640	1520	cmd.exe	104
PID 1520 wrote to memory of 2640	1520	cmd.exe	104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:". " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Windows\system32\findstr.exe
    findstr /b /c:". " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
    3⤵
    PID:4204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:".-.. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1020
- - C:\Windows\system32\findstr.exe
    findstr /b /c:".-.. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
    3⤵
    PID:5036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:".-.. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Windows\system32\findstr.exe
    findstr /b /c:".-.. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
    3⤵
    PID:3480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:"--- " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Windows\system32\findstr.exe
    findstr /b /c:"--- " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
    3⤵
    PID:1984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:".-- " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\system32\findstr.exe
    findstr /b /c:".-- " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
    3⤵
    PID:3864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:"--- " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Windows\system32\findstr.exe
    findstr /b /c:"--- " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
    3⤵
    PID:3992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:".-. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\system32\findstr.exe
    findstr /b /c:".-. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
    3⤵
    PID:1188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:".-.. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\system32\findstr.exe
    findstr /b /c:".-.. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
    3⤵
    PID:3592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b /c:"-.. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\system32\findstr.exe
    findstr /b /c:"-.. " "C:\Users\Admin\AppData\Local\Temp\morsáč.bat"
    3⤵
    PID:2640

Windows 7 deprecation

Loading Replay Monitor...

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads