2069c9b6142d998890d14900f6727296071ccce6093731ddece9fb07d36e0ab1

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
16/11/2023, 01:01

Target

112916ecfd36641bee54c1f0d700532c.exe
Size

2.0MB
MD5

112916ecfd36641bee54c1f0d700532c
SHA1

bd81ac098b338dfa4be1e6131d70df9a54bf9895
SHA256

2069c9b6142d998890d14900f6727296071ccce6093731ddece9fb07d36e0ab1
SHA512

2e00b0dccbedfa040e948d81f69930b196f6863cc81053215642de650df81a7f4b7f90a86e60a6cbe93f55469426651c24d43186887f29d02425583afd0da000
SSDEEP

24576:R99NMsQe6y+3iSHdYu2kxbLhZwyDaGXQ74kqG:f+eUSSWXehmtGW4s

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2684	Rubeus.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2436	2964	112916ecfd36641bee54c1f0d700532c.exe	29
PID 2964 wrote to memory of 2436	2964	112916ecfd36641bee54c1f0d700532c.exe	29
PID 2964 wrote to memory of 2436	2964	112916ecfd36641bee54c1f0d700532c.exe	29
PID 2436 wrote to memory of 2684	2436	cmd.exe	30
PID 2436 wrote to memory of 2684	2436	cmd.exe	30
PID 2436 wrote to memory of 2684	2436	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\112916ecfd36641bee54c1f0d700532c.exe
"C:\Users\Admin\AppData\Local\Temp\112916ecfd36641bee54c1f0d700532c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\system32\cmd.exe
  cmd.exe /C Rubeus.exe "kerberoast /rc4opsec"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Users\Admin\AppData\Local\Temp\Rubeus.exe
    Rubeus.exe "kerberoast /rc4opsec"
    3⤵
    - Executes dropped EXE
    PID:2684

C:\Users\Admin\AppData\Local\Temp\Rubeus.exe

Filesize
436KB

MD5
95ba181c0359495effef4a990365752f

SHA1
ca141a5ca933b36e72b345a250c6da07ec4284a9

SHA256
1bfbefa4ff4d0df3ee0090b5079cf84ed2e8d5377ba5b7a30afd88367d57b9ff

SHA512
461ce6ecfb840be0a17bd85bc424b473ce71a0af6fda88775facaa34c685034ce17bfe50299c1b8a09e692d3fc52d0ab65c5417eb9afcd32c7c46bc46915cd93

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rubeus.exe

Filesize
436KB

MD5
95ba181c0359495effef4a990365752f

SHA1
ca141a5ca933b36e72b345a250c6da07ec4284a9

SHA256
1bfbefa4ff4d0df3ee0090b5079cf84ed2e8d5377ba5b7a30afd88367d57b9ff

SHA512
461ce6ecfb840be0a17bd85bc424b473ce71a0af6fda88775facaa34c685034ce17bfe50299c1b8a09e692d3fc52d0ab65c5417eb9afcd32c7c46bc46915cd93

Download Submit
memory/2684-5-0x0000000000D00000-0x0000000000D74000-memory.dmp

Filesize
464KB

Download
memory/2684-6-0x000007FEF5940000-0x000007FEF632C000-memory.dmp

Filesize
9.9MB

Download