52fe4c7867042a5e60df8e2d74ac9fff51d906374ba3d7299c0ee8bc46f59529

Analysis

max time kernel
147s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Public/run.bat
Size

15KB
MD5

dc3e558fcc4e091a57ed9eafc47db270
SHA1

acf2de4e069dda1de34866cb5d953efeb6d50455
SHA256

17a08894935a660cae3bb1b5bcb3c55984138b7f46e5fae038c8482830618226
SHA512

365d2cbe3e6b60e34578ebc228d7715d893b15e9d893b18194d947fa2e1b5163c990873821ce85a964e67fb03ad84666119f62a978f5535a9b17b1487e535ed2
SSDEEP

192:XkZPtqxvl6V1pWhirR1mTCX1ww7CvFTm13Tvo4H45nZuejKkw7Q6fgXc9cb:UpOAVysO0QvU9Q4n1g7

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 5 IoCs

pid	Process
1912	adb.exe
2688	adb.exe
2700	adb.exe
3008	fastboot.exe
2720	adb.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 1912	2324	cmd.exe	29
PID 2324 wrote to memory of 1912	2324	cmd.exe	29
PID 2324 wrote to memory of 1912	2324	cmd.exe	29
PID 2324 wrote to memory of 1912	2324	cmd.exe	29
PID 2324 wrote to memory of 2688	2324	cmd.exe	30
PID 2324 wrote to memory of 2688	2324	cmd.exe	30
PID 2324 wrote to memory of 2688	2324	cmd.exe	30
PID 2324 wrote to memory of 2688	2324	cmd.exe	30
PID 2688 wrote to memory of 2268	2688	adb.exe	31
PID 2688 wrote to memory of 2268	2688	adb.exe	31
PID 2688 wrote to memory of 2268	2688	adb.exe	31
PID 2688 wrote to memory of 2268	2688	adb.exe	31
PID 2324 wrote to memory of 2860	2324	cmd.exe	32
PID 2324 wrote to memory of 2860	2324	cmd.exe	32
PID 2324 wrote to memory of 2860	2324	cmd.exe	32
PID 2860 wrote to memory of 2700	2860	cmd.exe	33
PID 2860 wrote to memory of 2700	2860	cmd.exe	33
PID 2860 wrote to memory of 2700	2860	cmd.exe	33
PID 2860 wrote to memory of 2700	2860	cmd.exe	33
PID 2324 wrote to memory of 2888	2324	cmd.exe	34
PID 2324 wrote to memory of 2888	2324	cmd.exe	34
PID 2324 wrote to memory of 2888	2324	cmd.exe	34
PID 2888 wrote to memory of 3008	2888	cmd.exe	35
PID 2888 wrote to memory of 3008	2888	cmd.exe	35
PID 2888 wrote to memory of 3008	2888	cmd.exe	35
PID 2888 wrote to memory of 3008	2888	cmd.exe	35
PID 2324 wrote to memory of 2752	2324	cmd.exe	36
PID 2324 wrote to memory of 2752	2324	cmd.exe	36
PID 2324 wrote to memory of 2752	2324	cmd.exe	36
PID 2752 wrote to memory of 2720	2752	cmd.exe	37
PID 2752 wrote to memory of 2720	2752	cmd.exe	37
PID 2752 wrote to memory of 2720	2752	cmd.exe	37
PID 2752 wrote to memory of 2720	2752	cmd.exe	37
PID 2752 wrote to memory of 2444	2752	cmd.exe	38
PID 2752 wrote to memory of 2444	2752	cmd.exe	38
PID 2752 wrote to memory of 2444	2752	cmd.exe	38
PID 2324 wrote to memory of 3004	2324	cmd.exe	39
PID 2324 wrote to memory of 3004	2324	cmd.exe	39
PID 2324 wrote to memory of 3004	2324	cmd.exe	39
PID 3004 wrote to memory of 2904	3004	cmd.exe	40
PID 3004 wrote to memory of 2904	3004	cmd.exe	40
PID 3004 wrote to memory of 2904	3004	cmd.exe	40

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Public\run.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Users\Admin\AppData\Local\Temp\Public\tools\adb.exe
  tools\adb kill-server
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:1912
- C:\Users\Admin\AppData\Local\Temp\Public\tools\adb.exe
  tools\adb start-server
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Users\Admin\AppData\Local\Temp\Public\tools\adb.exe
    adb fork-server server
    3⤵
    PID:2268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c tools\adb devices
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Users\Admin\AppData\Local\Temp\Public\tools\adb.exe
    tools\adb devices
    3⤵
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:2700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c tools\fastboot devices
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Users\Admin\AppData\Local\Temp\Public\tools\fastboot.exe
    tools\fastboot devices
    3⤵
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:3008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c tools\adb shell idme ? | find /I "bootmode"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Users\Admin\AppData\Local\Temp\Public\tools\adb.exe
    tools\adb shell idme ?
    3⤵
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:2720
- - C:\Windows\system32\find.exe
    find /I "bootmode"
    3⤵
    PID:2444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "findstr /b /c:":menu_" "C:\Users\Admin\AppData\Local\Temp\Public\run.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\system32\findstr.exe
    findstr /b /c:":menu_" "C:\Users\Admin\AppData\Local\Temp\Public\run.bat"
    3⤵
    PID:2904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3008-3-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads