c129c9aeefc2e80bc87b513b016b0536d772ea9f7835d9257a69b66fa2a2d261 | Triage

Resubmissions

06/03/2024, 22:01

240306-1xfcxsaf94 7

06/03/2024, 21:58

240306-1vjmkaaf42 6

Analysis

max time kernel
315s
max time network
1595s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
06/03/2024, 22:01

Sharing

Report Analysis Logs

General

Target

DDoS Tools Legacy/Close_XOIC.bat
Size

15B
MD5

621ca1f3e3ff3af2769fa0f3c19c6402
SHA1

9bb77cff45ca584645d51d58c7390940cd13ce62
SHA256

44c8c063bd63d1834f5504831101b880f9bec6b6b18258a5cc069c9f5e3b75f9
SHA512

08791d7001522653f5f027962856c365f426a63d2ed76edb18a9caa8430dcc737e563f30fd0cdc34631a93ed33313dd809f87dd500d6a1487e6b86014d278b97

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2792	tskill.exe
2792	tskill.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 2792	4952	cmd.exe	75
PID 4952 wrote to memory of 2792	4952	cmd.exe	75

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\DDoS Tools Legacy\Close_XOIC.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\system32\tskill.exe
  tskill XOIC* /a
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads