019cbdc39cce9b69a0b422cc3c19389b40c56c23979d79f789be771d08294d38

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b9194422e3db94f833f4abace43538dd.exe
Size 3.2MB
Sample240307-thpjqaga91
SHA256 019cbdc39cce9b69a0b422cc3c19389b40c56c23979d79f789be771d08294d38
MD5 b9194422e3db94f833f4abace43538dd
SHA1 1f7193e5c33585eb8ea6e8c32440668d4e791019
SHA512 79c782a6aa446c60f04be9b0daacbc068ce885c7e74b51a9961f266b72f81f94028a29b3beaba42b23b1709ea7aec49f079bfd82968bd04baf72a2428e971930
SSDEEP 98304:OVdw+bLySP4K84nUOywFhEejkG+FlS2Si5gYnYSmZIVN67MF5D5iO:OA+bLLQK84wwFPjkhlSaGUFmZYN67k5R
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4348	PING.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 4884	1936	b9194422e3db94f833f4abace43538dd.exe	100
PID 1936 wrote to memory of 4884	1936	b9194422e3db94f833f4abace43538dd.exe	100
PID 1936 wrote to memory of 4884	1936	b9194422e3db94f833f4abace43538dd.exe	100
PID 4884 wrote to memory of 4348	4884	cmd.exe	102
PID 4884 wrote to memory of 4348	4884	cmd.exe	102
PID 4884 wrote to memory of 4348	4884	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\b9194422e3db94f833f4abace43538dd.exe
"C:\Users\Admin\AppData\Local\Temp\b9194422e3db94f833f4abace43538dd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\b9194422e3db94f833f4abace43538dd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 3000
    3⤵
    - Runs ping.exe
    PID:4348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1936-0-0x0000000000400000-0x0000000000737000-memory.dmp

Download

memory/1936-1-0x0000000000400000-0x0000000000737000-memory.dmp

Download

memory/1936-3-0x0000000000400000-0x0000000000737000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads