ca1a698071bb2a73b3558f953c7b3e93e79586375b2b32364eec528c9e6aad29

Analysis

max time kernel
144s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Isisvideo.exe
Size

55KB
MD5

e75eef82eba9fb4946d6e9d42abd4fe5
SHA1

e1bc20e9648028ceca5a5f27549ac0c13aeb23f4
SHA256

edbf9376617abec8a3f8ca5726171917c6c690ca9471f38421cfcaab2e79a467
SHA512

0869606a04aac1a46572e1366855cbb711e1bd92950dfb9924fc1cfb17188529e6bf542e9213d20373f86c0628f587efd9891ba8125a6992b61833c189fa5469
SSDEEP

1536:x1qTXQOp6mG/Lqa823grKUfMQ7UnPQ1Bx:ozp6mOZ8ZhfNUnPQx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5068	pokemon.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3632	ipconfig.exe
2188	ipconfig.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 3008	4312	Isisvideo.exe	86
PID 4312 wrote to memory of 3008	4312	Isisvideo.exe	86
PID 4312 wrote to memory of 3008	4312	Isisvideo.exe	86
PID 4312 wrote to memory of 4752	4312	Isisvideo.exe	88
PID 4312 wrote to memory of 4752	4312	Isisvideo.exe	88
PID 4312 wrote to memory of 4752	4312	Isisvideo.exe	88
PID 4752 wrote to memory of 5068	4752	CMD.exe	90
PID 4752 wrote to memory of 5068	4752	CMD.exe	90
PID 4752 wrote to memory of 5068	4752	CMD.exe	90
PID 5068 wrote to memory of 3632	5068	pokemon.exe	92
PID 5068 wrote to memory of 3632	5068	pokemon.exe	92
PID 5068 wrote to memory of 3632	5068	pokemon.exe	92
PID 5068 wrote to memory of 2188	5068	pokemon.exe	93
PID 5068 wrote to memory of 2188	5068	pokemon.exe	93
PID 5068 wrote to memory of 2188	5068	pokemon.exe	93
PID 5068 wrote to memory of 3360	5068	pokemon.exe	97
PID 5068 wrote to memory of 3360	5068	pokemon.exe	97
PID 5068 wrote to memory of 3360	5068	pokemon.exe	97

C:\Users\Admin\AppData\Local\Temp\Isisvideo.exe
"C:\Users\Admin\AppData\Local\Temp\Isisvideo.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\SysWOW64\CMD.exe
  CMD /C Copy C:\Users\Admin\AppData\Local\Temp\ISISVI~1.EXE C:\Users\Admin\AppData\Local\Temp\pokemon.exe
  2⤵
  PID:3008
- C:\Windows\SysWOW64\CMD.exe
  CMD /C Start C:\Users\Admin\AppData\Local\Temp\pokemon.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Users\Admin\AppData\Local\Temp\pokemon.exe
    C:\Users\Admin\AppData\Local\Temp\pokemon.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5068
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /flushdns
      4⤵
      Gathers network information
      PID:3632
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /renew
      4⤵
      Gathers network information
      PID:2188
  - - C:\Windows\SysWOW64\CMD.exe
      CMD /C Start C:\Users\Admin\AppData\Local\{6L5UX~1\5l9geos5.exe
      4⤵
      PID:3360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pokemon.exe

Filesize
55KB

MD5
e75eef82eba9fb4946d6e9d42abd4fe5

SHA1
e1bc20e9648028ceca5a5f27549ac0c13aeb23f4

SHA256
edbf9376617abec8a3f8ca5726171917c6c690ca9471f38421cfcaab2e79a467

SHA512
0869606a04aac1a46572e1366855cbb711e1bd92950dfb9924fc1cfb17188529e6bf542e9213d20373f86c0628f587efd9891ba8125a6992b61833c189fa5469

Download Submit
C:\Users\Admin\AppData\Local\{6L5UX~1\5l9geos5.exe

Filesize
949B

MD5
8343187481d814c7da0e16fce6d1b508

SHA1
01e783291376c0cb6dbb465bf05934b1d067c894

SHA256
0632548940f934da53205441b68580638d9a93d57412d48c126bd7182a35424e

SHA512
98989b8f969b71d855b2abfb23d1f6cfe1f929cd087681ad80015d03a90be9f9d3e1b3cd3bf24a0d9d0af19d32cab3cbe7c566f1d408be965aa19c1af278dc38

Download Submit
memory/4312-6-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5068-20-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download