debd455391888928a84ae3fbc58d6bf40eb739c5caffe3d68c5c5e2734970186

Resubmissions

25/01/2024, 22:26

240125-2cwpvahehm1

25/01/2024, 17:53

240125-wgrnssdagl

25/01/2024, 17:25

240125-vzddfsceap10

Analysis

max time kernel
118s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Meet.exe
Size 469.8MB
Sample240125-2cwpvahehm
SHA256 debd455391888928a84ae3fbc58d6bf40eb739c5caffe3d68c5c5e2734970186
MD5 4f44f506dc54a3e6ecc2da93bc5966f5
SHA1 2a6671f8be6d2d5c09093f9a2715eb7a4aaba44b
SHA512 2821ec7493bd3cfb16bb59d06abf3907072a9ac50c3783208776c6c1e321eadc1b7640d398c113cb96ada33205981b6d43f17ce9ee3924ca2a72b28e50f42fbd
SSDEEP 6291456:3LN6SRoiJjOen+zQtaEeaszZv1xKRl35DCSpWgUPNlP/ikfuc5MYyGFNCx:3LN6SLJjOen3t+32pDZl6NxBlDY
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2788	ping.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2740	Meet.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2740	2188	Meet.exe	30
PID 2188 wrote to memory of 2740	2188	Meet.exe	30
PID 2188 wrote to memory of 2740	2188	Meet.exe	30
PID 2740 wrote to memory of 2788	2740	Meet.exe	31
PID 2740 wrote to memory of 2788	2740	Meet.exe	31
PID 2740 wrote to memory of 2788	2740	Meet.exe	31

C:\Users\Admin\AppData\Local\Temp\Meet.exe
"C:\Users\Admin\AppData\Local\Temp\Meet.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Users\Admin\AppData\Local\Temp\Meet.exe
  C:\Users\Admin\AppData\Local\Temp\Meet.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\system32\ping.exe
    ping -n 1 8.8.8.8
    3⤵
    - Runs ping.exe
    PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2188-1-0x000000013F920000-0x0000000140920000-memory.dmp

Download

memory/2740-0-0x000000013F920000-0x0000000140920000-memory.dmp

Download