9f4189a5317da63ebdd502c9a26f9f4f7661d4354f83c3be36e60a33fa93a067

Analysis

max time kernel
25s
max time network
40s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
21-02-2024 15:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

data/flutter_assets/assets/authenticator/kill.bat
Size

81B
MD5

b7a3b24f3ce07dc191d6a303e09fe771
SHA1

2a0a17251694b421a0fb2e012a428031a0cf4252
SHA256

29db72f16513fc90e93dee9613c9ff65d43c0fb85c86b6ba4dc6a4baca897a4c
SHA512

ed5fed9700b62de8fdeeb2463b39448355f0df8b913eadfd1176e64485b2ede5c9fe23bbd5cf948fb7bbfa1f903b4c66b6977f2a49d4ded69e5c2ec65aeec189

Score

1^/10

Malware Config

Signatures

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4672	NETSTAT.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4672	NETSTAT.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 4688	2756	cmd.exe	75
PID 2756 wrote to memory of 4688	2756	cmd.exe	75
PID 4688 wrote to memory of 4672	4688	cmd.exe	76
PID 4688 wrote to memory of 4672	4688	cmd.exe	76
PID 4688 wrote to memory of 4632	4688	cmd.exe	77
PID 4688 wrote to memory of 4632	4688	cmd.exe	77

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\data\flutter_assets\assets\authenticator\kill.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netstat -aon | find ":3551"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\system32\NETSTAT.EXE
    netstat -aon
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:4672
- - C:\Windows\system32\find.exe
    find ":3551"
    3⤵
    PID:4632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads