8c7a23c993848488152df25579c685a4e4dccac9d3faf177c897e3d884ac57a0

General

Target

Malicious_8c7a23c993848488152df25579c685a4e4dccac9d3faf177c897e3d884ac57a0.exe
Size

97KB
MD5

647b0861ad94eca105fb03008f5c38cf
SHA1

e7215c52fef8d717d410c755b5df98063a9d6deb
SHA256

8c7a23c993848488152df25579c685a4e4dccac9d3faf177c897e3d884ac57a0
SHA512

b1a8b8007a589d706118e4d5f0977c0d43a695009707f96c5426586c8ae30fe681809a4b942e2018bbd248884b5d0c48ab65a10972c3cf8377972f9fa34cfe41
SSDEEP

1536:+8KU95KLwKNw0KPwQrDBt/mBd/BVafU/opRQG5EsnJs8YTUo:+8n95KLwKwPwQrWdpofU/ortcYo

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 4944	5000	Malicious_8c7a23c993848488152df25579c685a4e4dccac9d3faf177c897e3d884ac57a0.exe	85
PID 5000 wrote to memory of 4944	5000	Malicious_8c7a23c993848488152df25579c685a4e4dccac9d3faf177c897e3d884ac57a0.exe	85
PID 5000 wrote to memory of 4944	5000	Malicious_8c7a23c993848488152df25579c685a4e4dccac9d3faf177c897e3d884ac57a0.exe	85
PID 5000 wrote to memory of 748	5000	Malicious_8c7a23c993848488152df25579c685a4e4dccac9d3faf177c897e3d884ac57a0.exe	86
PID 5000 wrote to memory of 748	5000	Malicious_8c7a23c993848488152df25579c685a4e4dccac9d3faf177c897e3d884ac57a0.exe	86
PID 5000 wrote to memory of 748	5000	Malicious_8c7a23c993848488152df25579c685a4e4dccac9d3faf177c897e3d884ac57a0.exe	86
PID 5000 wrote to memory of 3824	5000	Malicious_8c7a23c993848488152df25579c685a4e4dccac9d3faf177c897e3d884ac57a0.exe	87
PID 5000 wrote to memory of 3824	5000	Malicious_8c7a23c993848488152df25579c685a4e4dccac9d3faf177c897e3d884ac57a0.exe	87
PID 5000 wrote to memory of 3824	5000	Malicious_8c7a23c993848488152df25579c685a4e4dccac9d3faf177c897e3d884ac57a0.exe	87
PID 3824 wrote to memory of 4272	3824	cmd.exe	88
PID 3824 wrote to memory of 4272	3824	cmd.exe	88
PID 3824 wrote to memory of 4272	3824	cmd.exe	88
PID 5000 wrote to memory of 448	5000	Malicious_8c7a23c993848488152df25579c685a4e4dccac9d3faf177c897e3d884ac57a0.exe	89
PID 5000 wrote to memory of 448	5000	Malicious_8c7a23c993848488152df25579c685a4e4dccac9d3faf177c897e3d884ac57a0.exe	89
PID 5000 wrote to memory of 448	5000	Malicious_8c7a23c993848488152df25579c685a4e4dccac9d3faf177c897e3d884ac57a0.exe	89
PID 5000 wrote to memory of 4592	5000	Malicious_8c7a23c993848488152df25579c685a4e4dccac9d3faf177c897e3d884ac57a0.exe	90
PID 5000 wrote to memory of 4592	5000	Malicious_8c7a23c993848488152df25579c685a4e4dccac9d3faf177c897e3d884ac57a0.exe	90
PID 5000 wrote to memory of 4592	5000	Malicious_8c7a23c993848488152df25579c685a4e4dccac9d3faf177c897e3d884ac57a0.exe	90
PID 5000 wrote to memory of 1340	5000	Malicious_8c7a23c993848488152df25579c685a4e4dccac9d3faf177c897e3d884ac57a0.exe	91
PID 5000 wrote to memory of 1340	5000	Malicious_8c7a23c993848488152df25579c685a4e4dccac9d3faf177c897e3d884ac57a0.exe	91
PID 5000 wrote to memory of 1340	5000	Malicious_8c7a23c993848488152df25579c685a4e4dccac9d3faf177c897e3d884ac57a0.exe	91
PID 5000 wrote to memory of 1244	5000	Malicious_8c7a23c993848488152df25579c685a4e4dccac9d3faf177c897e3d884ac57a0.exe	92
PID 5000 wrote to memory of 1244	5000	Malicious_8c7a23c993848488152df25579c685a4e4dccac9d3faf177c897e3d884ac57a0.exe	92
PID 5000 wrote to memory of 1244	5000	Malicious_8c7a23c993848488152df25579c685a4e4dccac9d3faf177c897e3d884ac57a0.exe	92

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
4272	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Malicious_8c7a23c993848488152df25579c685a4e4dccac9d3faf177c897e3d884ac57a0.exe
"C:\Users\Admin\AppData\Local\Temp\Malicious_8c7a23c993848488152df25579c685a4e4dccac9d3faf177c897e3d884ac57a0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\myfiles" mkdir "C:\Users\Admin\AppData\Local\Temp\myfiles"
  2⤵
  PID:4944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\wxy" mkdir "C:\Users\Admin\AppData\Local\Temp\wxy"
  2⤵
  PID:748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c attrib +h C:\Users\Admin\AppData\Local\Temp\wxy
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h C:\Users\Admin\AppData\Local\Temp\wxy
    3⤵
    - Views/modifies file attributes
    PID:4272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c echo:0>C:\Users\Admin\AppData\Local\Temp\is64.txt
  2⤵
  PID:448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\is64.bat
  2⤵
  PID:4592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c
  2⤵
  PID:1340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:1244

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1

T1158

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is64.bat

Filesize
181B

MD5
225edee1d46e0a80610db26b275d72fb

SHA1
ce206abf11aaf19278b72f5021cc64b1b427b7e8

SHA256
e1befb57d724c9dc760cf42d7e0609212b22faeb2dc0c3ffe2fbd7134ff69559

SHA512
4f01a2a248a1322cb690b7395b818d2780e46f4884e59f1ab96125d642b6358eea97c7fad6023ef17209b218daa9c88d15ea2b92f124ecb8434c0c7b4a710504

Download Submit
C:\Users\Admin\AppData\Local\Temp\is64.txt

Filesize
3B

MD5
a5ea0ad9260b1550a14cc58d2c39b03d

SHA1
f0aedf295071ed34ab8c6a7692223d22b6a19841

SHA256
f1b2f662800122bed0ff255693df89c4487fbdcf453d3524a42d4ec20c3d9c04

SHA512
7c735c613ece191801114785c1ee26a0485cbf1e8ee2c3b85ba1ad290ef75eec9fede5e1a5dc26d504701f3542e6b6457818f4c1d62448d0db40d5f35c357d74

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads