2228f8f31dd0205e95b8608a07cd475157e2631f979926edbf242ec94fc65522

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 10:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

181bbd60c4e8b4740a0b2c9235d4a70a.exe
Size

470KB
MD5

181bbd60c4e8b4740a0b2c9235d4a70a
SHA1

a1ed8d55228533ae5fb19ab0ee45a300b0ebf457
SHA256

2228f8f31dd0205e95b8608a07cd475157e2631f979926edbf242ec94fc65522
SHA512

c17aca59cc0b5b20a130bd512b8f77a2544d5441d48e18fac773e0d3a3b729292fccbfd13cb5d3549ab709bc1b5b615776f541e9c0c5bef8520d4ff7895bcf0c
SSDEEP

12288:2B2pGhUr7J6wCqLQVH0TiU7uCAHD4VPLK/YiMS:2BUOYiV02ouCA8lK/1MS

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2696	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2612	PING.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2696	2160	181bbd60c4e8b4740a0b2c9235d4a70a.exe	31
PID 2160 wrote to memory of 2696	2160	181bbd60c4e8b4740a0b2c9235d4a70a.exe	31
PID 2160 wrote to memory of 2696	2160	181bbd60c4e8b4740a0b2c9235d4a70a.exe	31
PID 2160 wrote to memory of 2696	2160	181bbd60c4e8b4740a0b2c9235d4a70a.exe	31
PID 2696 wrote to memory of 2612	2696	cmd.exe	33
PID 2696 wrote to memory of 2612	2696	cmd.exe	33
PID 2696 wrote to memory of 2612	2696	cmd.exe	33
PID 2696 wrote to memory of 2612	2696	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\181bbd60c4e8b4740a0b2c9235d4a70a.exe
"C:\Users\Admin\AppData\Local\Temp\181bbd60c4e8b4740a0b2c9235d4a70a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\181bbd60c4e8b4740a0b2c9235d4a70a.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 3000
    3⤵
    - Runs ping.exe
    PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2160-0-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2160-1-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2160-2-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2160-4-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download