16603f4fc39bcfd99ad8d5fcbf6c44d98f72503c9cec2fd2469c5d56b5438087

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1d29b84e03971ddbf5d85922dc1aaa9c.exe
Size

385KB
MD5

1d29b84e03971ddbf5d85922dc1aaa9c
SHA1

90e008812ceb5cc810a30ad0988a734b4c7bbab2
SHA256

16603f4fc39bcfd99ad8d5fcbf6c44d98f72503c9cec2fd2469c5d56b5438087
SHA512

2c67982f976676179bb9fe13afa3dbad48ddbfcb2460d736b1f3638256ac6696dcd6d9da044453caa9c9cf719c7f67ba749a826e81575aad35d1046410be490a
SSDEEP

6144:POsXoLOVtbupBAtd53V6ommb9ZlyvkaV1vJ9DT3zksFYpadWxeC:msJVtKzKLFHlyMuX6ad1C

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2604	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3032	PING.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2604	2360	1d29b84e03971ddbf5d85922dc1aaa9c.exe	32
PID 2360 wrote to memory of 2604	2360	1d29b84e03971ddbf5d85922dc1aaa9c.exe	32
PID 2360 wrote to memory of 2604	2360	1d29b84e03971ddbf5d85922dc1aaa9c.exe	32
PID 2360 wrote to memory of 2604	2360	1d29b84e03971ddbf5d85922dc1aaa9c.exe	32
PID 2604 wrote to memory of 3032	2604	cmd.exe	30
PID 2604 wrote to memory of 3032	2604	cmd.exe	30
PID 2604 wrote to memory of 3032	2604	cmd.exe	30
PID 2604 wrote to memory of 3032	2604	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\1d29b84e03971ddbf5d85922dc1aaa9c.exe
"C:\Users\Admin\AppData\Local\Temp\1d29b84e03971ddbf5d85922dc1aaa9c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\1d29b84e03971ddbf5d85922dc1aaa9c.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2604

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
1⤵
- Runs ping.exe
PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2360-1-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2360-0-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2360-2-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2360-3-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download