12f9617cdb6eabf7f8d79e407c0261eaf559cec6694fc4476ea987daceff5e1d

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 22:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

40c28fb8e0247b6cafbdad1885235b55.exe
Size

470KB
MD5

40c28fb8e0247b6cafbdad1885235b55
SHA1

219049b06b6891f3a7be3d27c01c929a82763991
SHA256

12f9617cdb6eabf7f8d79e407c0261eaf559cec6694fc4476ea987daceff5e1d
SHA512

7e4bae2db5062efb80bebd1656070f95c1aac6a9a1717b40adeb8cfdb78b8b4585b8223af3fc3dca4372b95dcc0f2700d25186b5bfd14c16a85ba1ead40b32ea
SSDEEP

12288:I9PbRDW1CDgZO0Zlvns1Z5JrsvdMs5p9tz3dNA:IDDWmgU0Zlvns1Z5JoVNBdNA

Score

1^/10

Malware Config

Signatures

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2160	PING.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 3620	780	40c28fb8e0247b6cafbdad1885235b55.exe	94
PID 780 wrote to memory of 3620	780	40c28fb8e0247b6cafbdad1885235b55.exe	94
PID 780 wrote to memory of 3620	780	40c28fb8e0247b6cafbdad1885235b55.exe	94
PID 3620 wrote to memory of 2160	3620	cmd.exe	97
PID 3620 wrote to memory of 2160	3620	cmd.exe	97
PID 3620 wrote to memory of 2160	3620	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\40c28fb8e0247b6cafbdad1885235b55.exe
"C:\Users\Admin\AppData\Local\Temp\40c28fb8e0247b6cafbdad1885235b55.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\40c28fb8e0247b6cafbdad1885235b55.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 3000
    3⤵
    - Runs ping.exe
    PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/780-0-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/780-1-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/780-2-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/780-5-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download