24728f2a2e8583bd39b01141f49a4afe3ffe37f25930a1fa072c7149918fb05d

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4da203d4f6d12683057d2aa2f614a649.exe
Size

458KB
MD5

4da203d4f6d12683057d2aa2f614a649
SHA1

a991ce645da589c31247f3df132358d96ede6ec1
SHA256

24728f2a2e8583bd39b01141f49a4afe3ffe37f25930a1fa072c7149918fb05d
SHA512

e7f21a030705136cd7aa59e74ce8a63c27594bf4e53caf014e3d141ca374e4ff9d4a7db11d9ddba235fbefa89f8f37b2d090ae3b959e345a9c855064060b9411
SSDEEP

6144:aJ6VANOasIMiWxBdMt3VcOmHiMGyWbeSXR7e80sY7nXcu:acObyByt3VEgFe9Xcu

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2700	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2496	PING.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2700	2792	4da203d4f6d12683057d2aa2f614a649.exe	33
PID 2792 wrote to memory of 2700	2792	4da203d4f6d12683057d2aa2f614a649.exe	33
PID 2792 wrote to memory of 2700	2792	4da203d4f6d12683057d2aa2f614a649.exe	33
PID 2792 wrote to memory of 2700	2792	4da203d4f6d12683057d2aa2f614a649.exe	33
PID 2700 wrote to memory of 2496	2700	cmd.exe	31
PID 2700 wrote to memory of 2496	2700	cmd.exe	31
PID 2700 wrote to memory of 2496	2700	cmd.exe	31
PID 2700 wrote to memory of 2496	2700	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\4da203d4f6d12683057d2aa2f614a649.exe
"C:\Users\Admin\AppData\Local\Temp\4da203d4f6d12683057d2aa2f614a649.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\4da203d4f6d12683057d2aa2f614a649.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2700

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
1⤵
- Runs ping.exe
PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2792-1-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2792-0-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2792-2-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2792-4-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download