Analysis
-
max time kernel
20s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26-12-2023 02:37
Static task
static1
Behavioral task
behavioral1
Sample
4d226048a0fd6d5a0423cba792d5fe4a.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
4d226048a0fd6d5a0423cba792d5fe4a.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
4d226048a0fd6d5a0423cba792d5fe4a.exe
-
Size
374KB
-
MD5
4d226048a0fd6d5a0423cba792d5fe4a
-
SHA1
136c77aca9c08cba210d0bd89f3305ea5be1a4ea
-
SHA256
20519a70d43b5cf743ba936cd3b6e6396e0f1ecdf87f603ff0b5a79b1bc38105
-
SHA512
87ae9b4fa116dc22c57df41669d3edcc049504e7c02137bc95981cb6e6da34636c5ad11e07edd32c51392b7ae1e801c572d43cff62a3448a9fdd23bc998d2e96
-
SSDEEP
6144:RNxnbYCM4B337HHHHHHHHHHHHHJEuZHLPorMH8YAvjHvHH2LVGkyHHHHHHHHHHHQ:vxbYuHHHHHHHHHHHHH2uZHLPorMH8YAc
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2728 cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2564 PING.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1244 wrote to memory of 2728 1244 4d226048a0fd6d5a0423cba792d5fe4a.exe 32 PID 1244 wrote to memory of 2728 1244 4d226048a0fd6d5a0423cba792d5fe4a.exe 32 PID 1244 wrote to memory of 2728 1244 4d226048a0fd6d5a0423cba792d5fe4a.exe 32 PID 1244 wrote to memory of 2728 1244 4d226048a0fd6d5a0423cba792d5fe4a.exe 32 PID 2728 wrote to memory of 2564 2728 cmd.exe 34 PID 2728 wrote to memory of 2564 2728 cmd.exe 34 PID 2728 wrote to memory of 2564 2728 cmd.exe 34 PID 2728 wrote to memory of 2564 2728 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d226048a0fd6d5a0423cba792d5fe4a.exe"C:\Users\Admin\AppData\Local\Temp\4d226048a0fd6d5a0423cba792d5fe4a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\4d226048a0fd6d5a0423cba792d5fe4a.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30003⤵
- Runs ping.exe
PID:2564
-
-