644b06eaa8603d57be7d6eeaac2c30c248eb272f178a5702e3983a9787f80c89

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

131aace1b5136d6e9ffd0ed086338b60.exe
Size

137KB
MD5

131aace1b5136d6e9ffd0ed086338b60
SHA1

6381812c77a9b9dd23a145fe5ca77356ef828ffa
SHA256

644b06eaa8603d57be7d6eeaac2c30c248eb272f178a5702e3983a9787f80c89
SHA512

65ddb221b175c9e4386a51e33df4dcc135d0db0b795ecbc07b8429995ae78327b6a456d7b78b821b965977de1312518caf1846ac92f9cfa594906dfa78c32f4e
SSDEEP

3072:KbPN+Vmn91ASZ4L016HxawPQrwmy5MmtiJCMAiTBtPiSfL/U:KvJZJ1Gx9uwmy7g0biTj

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2516	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2516	2508	131aace1b5136d6e9ffd0ed086338b60.exe	29
PID 2508 wrote to memory of 2516	2508	131aace1b5136d6e9ffd0ed086338b60.exe	29
PID 2508 wrote to memory of 2516	2508	131aace1b5136d6e9ffd0ed086338b60.exe	29
PID 2508 wrote to memory of 2516	2508	131aace1b5136d6e9ffd0ed086338b60.exe	29

C:\Users\Admin\AppData\Local\Temp\131aace1b5136d6e9ffd0ed086338b60.exe
"C:\Users\Admin\AppData\Local\Temp\131aace1b5136d6e9ffd0ed086338b60.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Rkv..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2508-2-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2508-1-0x0000000000220000-0x000000000024F000-memory.dmp

Filesize
188KB

Download
memory/2508-0-0x0000000000220000-0x000000000024F000-memory.dmp

Filesize
188KB

Download
memory/2508-4-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download