05c9c456cad09ae6bf8f5a879a0c86ccc94a5b987e14b4e3c1433672897e2577 | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03-01-2024 08:22

Sharing

Report Analysis Logs

General

Target

XDisk.exe
Size

157KB
MD5

b6bbdd51556f752b034a1a74f54808e2
SHA1

5d300ea856c27974dbd7b58401141c303b1db608
SHA256

05c9c456cad09ae6bf8f5a879a0c86ccc94a5b987e14b4e3c1433672897e2577
SHA512

e69a3f2b3c4aa2085d69aa1860409aab89c0307070b53ab03bcc66aba154f10c80f34785d272c08bc43fb75be40b3fea07d10a1c4bb7c9566a7a0012c57b850c
SSDEEP

3072:Z/25jvDSgsqsb5Uh28vAbTV1WW69B9VjMdxPedN9ug0z9TBfFSZlR:0tzsb5Uh28+V1WW69B9VjMdxPedN9ugd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2540	2232	XDisk.exe	29
PID 2232 wrote to memory of 2540	2232	XDisk.exe	29
PID 2232 wrote to memory of 2540	2232	XDisk.exe	29
PID 2540 wrote to memory of 2252	2540	cmd.exe	30
PID 2540 wrote to memory of 2252	2540	cmd.exe	30
PID 2540 wrote to memory of 2252	2540	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\XDisk.exe
"C:\Users\Admin\AppData\Local\Temp\XDisk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\145B.tmp\145C.tmp\145D.bat C:\Users\Admin\AppData\Local\Temp\XDisk.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Windows\system32\fsutil.exe
    fsutil dirty query C:
    3⤵
    PID:2252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\145B.tmp\145C.tmp\145D.bat

Filesize
4KB

MD5
352624356f36096186e2a1a232d2d82c

SHA1
b6cc3780ae2b263a8f4dd1bc3f268c063a07d169

SHA256
4c7f7b8ce59254d77181c4edfc693c6e7ae8e1d26ace9a18cb81cf9345229aa8

SHA512
9aabec2f9d5c1945ca089b2b60a982373bbb952664bed3958bbef0e266623a37ffee9c784eab3533dd5fdffeffc2911f27bdcc59917e39ae9e16b9e2371a943b

Download Submit