696431978daadd33a28841320659835ba8db8080a535b8f35e9e60701ab8b491 | Triage

Resubmissions

29-06-2023 14:46

230629-r5stjsdf66 5

29-06-2023 14:43

230629-r3tm3aed4y 5

Analysis

max time kernel
42s
max time network
53s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
29-06-2023 14:43

Sharing

Report Analysis Logs

General

Target

cmdline-tools/bin/retrace.bat
Size

2KB
MD5

7c6c0d79b61e2c6ecc47e6d28137c187
SHA1

0a168aa95bd98d70ade751839426b6b64b832cc5
SHA256

622e033feea65ef9572f4d4778f78d3f925ad8981bb6c824dc31ddd471bd01f3
SHA512

3db1facf4337571aced3574521600f90a2451f6314f46272f996396616b4afcd797a124a245cca02eea32c668bd76cb0e13bc236ae2fe898f23c36698cb8d474

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 1952	1744	cmd.exe	28
PID 1744 wrote to memory of 1952	1744	cmd.exe	28
PID 1744 wrote to memory of 1952	1744	cmd.exe	28
PID 1744 wrote to memory of 1708	1744	cmd.exe	29
PID 1744 wrote to memory of 1708	1744	cmd.exe	29
PID 1744 wrote to memory of 1708	1744	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\retrace.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\system32\java.exe
  java.exe -version
  2⤵
  PID:1952
- C:\Windows\system32\java.exe
  "java.exe" -classpath "C:\Users\Admin\AppData\Local\Temp\cmdline-tools\bin\..\lib\retrace-classpath.jar" com.android.tools.r8.retrace.Retrace
  2⤵
  PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1708-75-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/1952-64-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download