30bd223682860223d79055c63f81f1682d6e73a9ca113d1be11514bede333d9c

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2023 21:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13942b2cc969542957170cbb4a6ef752.exe
Size

461KB
MD5

13942b2cc969542957170cbb4a6ef752
SHA1

6e01bc5414b8e5786aae640de2ad354efa54ba05
SHA256

30bd223682860223d79055c63f81f1682d6e73a9ca113d1be11514bede333d9c
SHA512

49d105939279bc3fb2101c83c8c0c19fa4119cbfe11d3c4042903cbe5eb480bf486e9d3890de695f57165f37578e5b28cc88f4f07eb2d67c5d1c38fd4954c4dc
SSDEEP

12288:zDFwMZFUlpkyPJRIp2VZZuLQyEmDFTzFl0R1CJgrZ:zZwKSlp5ZUUyTFY1CJgrZ

Score

1^/10

Malware Config

Signatures

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3548	PING.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 4964	4796	13942b2cc969542957170cbb4a6ef752.exe	107
PID 4796 wrote to memory of 4964	4796	13942b2cc969542957170cbb4a6ef752.exe	107
PID 4796 wrote to memory of 4964	4796	13942b2cc969542957170cbb4a6ef752.exe	107
PID 4964 wrote to memory of 3548	4964	cmd.exe	105
PID 4964 wrote to memory of 3548	4964	cmd.exe	105
PID 4964 wrote to memory of 3548	4964	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\13942b2cc969542957170cbb4a6ef752.exe
"C:\Users\Admin\AppData\Local\Temp\13942b2cc969542957170cbb4a6ef752.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\13942b2cc969542957170cbb4a6ef752.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4964

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
1⤵
- Runs ping.exe
PID:3548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4796-0-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4796-1-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4796-11-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download