16603f4fc39bcfd99ad8d5fcbf6c44d98f72503c9cec2fd2469c5d56b5438087

Analysis

max time kernel
140s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1d29b84e03971ddbf5d85922dc1aaa9c.exe
Size

385KB
MD5

1d29b84e03971ddbf5d85922dc1aaa9c
SHA1

90e008812ceb5cc810a30ad0988a734b4c7bbab2
SHA256

16603f4fc39bcfd99ad8d5fcbf6c44d98f72503c9cec2fd2469c5d56b5438087
SHA512

2c67982f976676179bb9fe13afa3dbad48ddbfcb2460d736b1f3638256ac6696dcd6d9da044453caa9c9cf719c7f67ba749a826e81575aad35d1046410be490a
SSDEEP

6144:POsXoLOVtbupBAtd53V6ommb9ZlyvkaV1vJ9DT3zksFYpadWxeC:msJVtKzKLFHlyMuX6ad1C

Score

1^/10

Malware Config

Signatures

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3476	PING.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 4364	4676	1d29b84e03971ddbf5d85922dc1aaa9c.exe	99
PID 4676 wrote to memory of 4364	4676	1d29b84e03971ddbf5d85922dc1aaa9c.exe	99
PID 4676 wrote to memory of 4364	4676	1d29b84e03971ddbf5d85922dc1aaa9c.exe	99
PID 4364 wrote to memory of 3476	4364	cmd.exe	97
PID 4364 wrote to memory of 3476	4364	cmd.exe	97
PID 4364 wrote to memory of 3476	4364	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\1d29b84e03971ddbf5d85922dc1aaa9c.exe
"C:\Users\Admin\AppData\Local\Temp\1d29b84e03971ddbf5d85922dc1aaa9c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\1d29b84e03971ddbf5d85922dc1aaa9c.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4364

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
1⤵
- Runs ping.exe
PID:3476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4676-0-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/4676-1-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/4676-2-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download