4605743d52d2ffb682496b88cd8d436ce03e878a822eac4b5c52d0d428f24c40 | Triage

Analysis

max time kernel
142s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 16:08

Sharing

Report Analysis Logs

General

Target

ICS_rooting/runit-win.bat
Size

1KB
MD5

a4970bf3bc94c53312919ebad0337b46
SHA1

3744e0aa7521b225187303b87a4379bfbf045dcf
SHA256

ee01fa2b28a8b71c81528d7b1e8d978766cf95b5769a05e9638a25f30d8d8345
SHA512

5523c18ac78cf3873151fe66c89121223ba54ebb32664e49e5f30ef852ab07a8176b007e9bd8d8c1de54dd42acfd0a63e8974afe329921a03bdb6507a73bec51

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
1632	adb.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 1632	1052	cmd.exe	16
PID 1052 wrote to memory of 1632	1052	cmd.exe	16
PID 1052 wrote to memory of 1632	1052	cmd.exe	16
PID 1052 wrote to memory of 1632	1052	cmd.exe	16
PID 1632 wrote to memory of 2164	1632	adb.exe	30
PID 1632 wrote to memory of 2164	1632	adb.exe	30
PID 1632 wrote to memory of 2164	1632	adb.exe	30
PID 1632 wrote to memory of 2164	1632	adb.exe	30

C:\Users\Admin\AppData\Local\Temp\ICS_rooting\adb.exe
adb wait-for-device
1⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Users\Admin\AppData\Local\Temp\ICS_rooting\adb.exe
  adb fork-server server
  2⤵
  PID:2164

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\ICS_rooting\runit-win.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1632-0-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2164-1-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2164-3-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download