05478cafb1e06608ebcc92c9b6bc833a334197bddf4c197b53bf3558fb09252b

Analysis

max time kernel
119s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 03:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

01d7b951fe0ef1017e19e2a77604e081.exe
Size

3.2MB
MD5

01d7b951fe0ef1017e19e2a77604e081
SHA1

064a5cd4967e8c35dca2048048f1310df8dd4355
SHA256

05478cafb1e06608ebcc92c9b6bc833a334197bddf4c197b53bf3558fb09252b
SHA512

8ffd51c9d3da216f1cc0ab7c31dde155e18f240d36cd0b1cb5ab43c717e958f67f6485e8b23eaa13493be09fdcf8d2cb95408f51195500196122a978d34c87a6
SSDEEP

98304:9d4+bLy6P4K84nFOywFhEejkL+FlS2Si5xAZnYSmZIVNbMF5GqT5iOC:Q+bLbQK849wFPjkglSaHOFmZYNbk5HiV

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2544	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2620	PING.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 2544	1072	01d7b951fe0ef1017e19e2a77604e081.exe	31
PID 1072 wrote to memory of 2544	1072	01d7b951fe0ef1017e19e2a77604e081.exe	31
PID 1072 wrote to memory of 2544	1072	01d7b951fe0ef1017e19e2a77604e081.exe	31
PID 1072 wrote to memory of 2544	1072	01d7b951fe0ef1017e19e2a77604e081.exe	31
PID 2544 wrote to memory of 2620	2544	cmd.exe	33
PID 2544 wrote to memory of 2620	2544	cmd.exe	33
PID 2544 wrote to memory of 2620	2544	cmd.exe	33
PID 2544 wrote to memory of 2620	2544	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\01d7b951fe0ef1017e19e2a77604e081.exe
"C:\Users\Admin\AppData\Local\Temp\01d7b951fe0ef1017e19e2a77604e081.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\01d7b951fe0ef1017e19e2a77604e081.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 3000
    3⤵
    - Runs ping.exe
    PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1072-0-0x0000000000400000-0x0000000000734000-memory.dmp

Filesize
3.2MB

Download
memory/1072-1-0x0000000000400000-0x0000000000734000-memory.dmp

Filesize
3.2MB

Download
memory/1072-2-0x0000000000400000-0x0000000000734000-memory.dmp

Filesize
3.2MB

Download
memory/1072-4-0x0000000000400000-0x0000000000734000-memory.dmp

Filesize
3.2MB

Download