05c9c456cad09ae6bf8f5a879a0c86ccc94a5b987e14b4e3c1433672897e2577 | Triage

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03-01-2024 08:22

Sharing

Report Analysis Logs

General

Target

XDisk.exe
Size

157KB
MD5

b6bbdd51556f752b034a1a74f54808e2
SHA1

5d300ea856c27974dbd7b58401141c303b1db608
SHA256

05c9c456cad09ae6bf8f5a879a0c86ccc94a5b987e14b4e3c1433672897e2577
SHA512

e69a3f2b3c4aa2085d69aa1860409aab89c0307070b53ab03bcc66aba154f10c80f34785d272c08bc43fb75be40b3fea07d10a1c4bb7c9566a7a0012c57b850c
SSDEEP

3072:Z/25jvDSgsqsb5Uh28vAbTV1WW69B9VjMdxPedN9ug0z9TBfFSZlR:0tzsb5Uh28+V1WW69B9VjMdxPedN9ugd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 876	1096	XDisk.exe	17
PID 1096 wrote to memory of 876	1096	XDisk.exe	17
PID 876 wrote to memory of 3596	876	cmd.exe	18
PID 876 wrote to memory of 3596	876	cmd.exe	18

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\40C2.tmp\40C3.tmp\40C4.bat C:\Users\Admin\AppData\Local\Temp\XDisk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:876
- C:\Windows\system32\fsutil.exe
  fsutil dirty query C:
  2⤵
  PID:3596

C:\Users\Admin\AppData\Local\Temp\XDisk.exe
"C:\Users\Admin\AppData\Local\Temp\XDisk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads