611126bebd139c6b9bec1a57bb5b030a99d9febf88c47749614d22925c3ffb88

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 20:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

11462619db034601aa877db11f7d6bd5.exe
Size

374KB
MD5

11462619db034601aa877db11f7d6bd5
SHA1

7669bca73e50a00af0d2d91b86052228bd61ef31
SHA256

611126bebd139c6b9bec1a57bb5b030a99d9febf88c47749614d22925c3ffb88
SHA512

3d3e634ba30eff6f6553c41896d340f87266f4c1e24a6b84f34017ef661fad63b14c8e8371ed331905fc40f0e4c8285be67f6ea2e9a6b3728cd8683396dd5415
SSDEEP

6144:qazxDXDxEA4wqbtUxvJdvwDkf8A0QgEnH+9YnXx4TkZNpgL064UPxFa:qixEALqbtU/d44CEe9yXuTkZS0Ca

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2716	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2892	PING.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2716	2372	11462619db034601aa877db11f7d6bd5.exe	32
PID 2372 wrote to memory of 2716	2372	11462619db034601aa877db11f7d6bd5.exe	32
PID 2372 wrote to memory of 2716	2372	11462619db034601aa877db11f7d6bd5.exe	32
PID 2372 wrote to memory of 2716	2372	11462619db034601aa877db11f7d6bd5.exe	32
PID 2716 wrote to memory of 2892	2716	cmd.exe	30
PID 2716 wrote to memory of 2892	2716	cmd.exe	30
PID 2716 wrote to memory of 2892	2716	cmd.exe	30
PID 2716 wrote to memory of 2892	2716	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\11462619db034601aa877db11f7d6bd5.exe
"C:\Users\Admin\AppData\Local\Temp\11462619db034601aa877db11f7d6bd5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\11462619db034601aa877db11f7d6bd5.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2716

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
1⤵
- Runs ping.exe
PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2372-0-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2372-1-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2372-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2372-3-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download