debd455391888928a84ae3fbc58d6bf40eb739c5caffe3d68c5c5e2734970186

Resubmissions

25/01/2024, 22:26

25/01/2024, 17:25

max time kernel
118s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 22:26

Target

Meet.exe
Size

469.8MB
MD5

4f44f506dc54a3e6ecc2da93bc5966f5
SHA1

2a6671f8be6d2d5c09093f9a2715eb7a4aaba44b
SHA256

debd455391888928a84ae3fbc58d6bf40eb739c5caffe3d68c5c5e2734970186
SHA512

2821ec7493bd3cfb16bb59d06abf3907072a9ac50c3783208776c6c1e321eadc1b7640d398c113cb96ada33205981b6d43f17ce9ee3924ca2a72b28e50f42fbd
SSDEEP

6291456:3LN6SRoiJjOen+zQtaEeaszZv1xKRl35DCSpWgUPNlP/ikfuc5MYyGFNCx:3LN6SLJjOen3t+32pDZl6NxBlDY

Score

1^/10

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
2788	ping.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2740	Meet.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2740	2188	Meet.exe	30
PID 2188 wrote to memory of 2740	2188	Meet.exe	30
PID 2188 wrote to memory of 2740	2188	Meet.exe	30
PID 2740 wrote to memory of 2788	2740	Meet.exe	31
PID 2740 wrote to memory of 2788	2740	Meet.exe	31
PID 2740 wrote to memory of 2788	2740	Meet.exe	31

C:\Users\Admin\AppData\Local\Temp\Meet.exe
"C:\Users\Admin\AppData\Local\Temp\Meet.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Users\Admin\AppData\Local\Temp\Meet.exe
  C:\Users\Admin\AppData\Local\Temp\Meet.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\system32\ping.exe
    ping -n 1 8.8.8.8
    3⤵
    - Runs ping.exe
    PID:2788

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2188-1-0x000000013F920000-0x0000000140920000-memory.dmp

Filesize
16.0MB

Download
memory/2740-0-0x000000013F920000-0x0000000140920000-memory.dmp

Filesize
16.0MB

Download