05c9c456cad09ae6bf8f5a879a0c86ccc94a5b987e14b4e3c1433672897e2577 | Triage

Analysis

max time kernel
18s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
03-01-2024 09:12

Sharing

Report Analysis Logs

General

Target

XDisk.exe
Size

157KB
MD5

b6bbdd51556f752b034a1a74f54808e2
SHA1

5d300ea856c27974dbd7b58401141c303b1db608
SHA256

05c9c456cad09ae6bf8f5a879a0c86ccc94a5b987e14b4e3c1433672897e2577
SHA512

e69a3f2b3c4aa2085d69aa1860409aab89c0307070b53ab03bcc66aba154f10c80f34785d272c08bc43fb75be40b3fea07d10a1c4bb7c9566a7a0012c57b850c
SSDEEP

3072:Z/25jvDSgsqsb5Uh28vAbTV1WW69B9VjMdxPedN9ug0z9TBfFSZlR:0tzsb5Uh28+V1WW69B9VjMdxPedN9ugd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 2024	532	XDisk.exe	19
PID 532 wrote to memory of 2024	532	XDisk.exe	19
PID 2024 wrote to memory of 3140	2024	cmd.exe	17
PID 2024 wrote to memory of 3140	2024	cmd.exe	17

C:\Windows\system32\fsutil.exe
fsutil dirty query C:
1⤵
PID:3140

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\7484.tmp\7485.tmp\7486.bat C:\Users\Admin\AppData\Local\Temp\XDisk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2024

C:\Users\Admin\AppData\Local\Temp\XDisk.exe
"C:\Users\Admin\AppData\Local\Temp\XDisk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7484.tmp\7485.tmp\7486.bat

Filesize
4KB

MD5
352624356f36096186e2a1a232d2d82c

SHA1
b6cc3780ae2b263a8f4dd1bc3f268c063a07d169

SHA256
4c7f7b8ce59254d77181c4edfc693c6e7ae8e1d26ace9a18cb81cf9345229aa8

SHA512
9aabec2f9d5c1945ca089b2b60a982373bbb952664bed3958bbef0e266623a37ffee9c784eab3533dd5fdffeffc2911f27bdcc59917e39ae9e16b9e2371a943b

Download Submit