13347ff57f098a8133b271865462f9a6e2ba3dc419d5c5a5bd97f31b7d34abbb

Analysis

max time kernel
198s
max time network
235s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 02:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4db37f032eb8e5a52d33ff0a12a18a2f.exe
Size

454KB
MD5

4db37f032eb8e5a52d33ff0a12a18a2f
SHA1

a8811c00381e5877c201ca26097281baa11c0d45
SHA256

13347ff57f098a8133b271865462f9a6e2ba3dc419d5c5a5bd97f31b7d34abbb
SHA512

e3873a85d97af3529ef7fc573724b5d74b3357c196263d1eca2967afac7b0917a84063a0cc8654fb4cc615df2b25626f74b5340080b71d418e5333032f054486
SSDEEP

6144:ZA91W/5SQfT4qIIP4VSvJdttnntDRwlfOhGHV6HIQz4DHPV+myqtEO5cY6g3ULjG:XBSsEqIIP4Vmt+gHFUD9wB6hl3ULjOVz

Score

1^/10

Malware Config

Signatures

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
880	PING.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2424	2440	4db37f032eb8e5a52d33ff0a12a18a2f.exe	96
PID 2440 wrote to memory of 2424	2440	4db37f032eb8e5a52d33ff0a12a18a2f.exe	96
PID 2440 wrote to memory of 2424	2440	4db37f032eb8e5a52d33ff0a12a18a2f.exe	96
PID 2424 wrote to memory of 880	2424	cmd.exe	99
PID 2424 wrote to memory of 880	2424	cmd.exe	99
PID 2424 wrote to memory of 880	2424	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\4db37f032eb8e5a52d33ff0a12a18a2f.exe
"C:\Users\Admin\AppData\Local\Temp\4db37f032eb8e5a52d33ff0a12a18a2f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\4db37f032eb8e5a52d33ff0a12a18a2f.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 3000
    3⤵
    - Runs ping.exe
    PID:880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2440-0-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2440-1-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2440-2-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2440-8-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download