4678fd4cd80881bfa998ed370ba111801db04b740e036332f021a5f3967b5fa7

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 08:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

611132d1e7dbc064ebd6fbd3c263fca0.exe
Size

458KB
MD5

611132d1e7dbc064ebd6fbd3c263fca0
SHA1

2795e4dfe60d993990390b9dcf6e95c96a981026
SHA256

4678fd4cd80881bfa998ed370ba111801db04b740e036332f021a5f3967b5fa7
SHA512

149ba1ea4512aa8bc5965b3e0f4f68cbf0b754af92be112db43ab9fe156782db5db45f121ca964f406b9e61e3b4782fcd85fb6a580bb44c15801590869419f36
SSDEEP

12288:KWIAx8ZYuV2fvdhHWme2Vt6rhjWE9PUXK:KW4ZpeWme2f8hq6PUXK

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2616	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2612	PING.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2616	2088	611132d1e7dbc064ebd6fbd3c263fca0.exe	30
PID 2088 wrote to memory of 2616	2088	611132d1e7dbc064ebd6fbd3c263fca0.exe	30
PID 2088 wrote to memory of 2616	2088	611132d1e7dbc064ebd6fbd3c263fca0.exe	30
PID 2088 wrote to memory of 2616	2088	611132d1e7dbc064ebd6fbd3c263fca0.exe	30
PID 2616 wrote to memory of 2612	2616	cmd.exe	32
PID 2616 wrote to memory of 2612	2616	cmd.exe	32
PID 2616 wrote to memory of 2612	2616	cmd.exe	32
PID 2616 wrote to memory of 2612	2616	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\611132d1e7dbc064ebd6fbd3c263fca0.exe
"C:\Users\Admin\AppData\Local\Temp\611132d1e7dbc064ebd6fbd3c263fca0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\611132d1e7dbc064ebd6fbd3c263fca0.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 3000
    3⤵
    - Runs ping.exe
    PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2088-0-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2088-1-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2088-2-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2088-3-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download