d9c6ba096bc85554d5e3adff83edb5c97c179bd28f21bff3c4969786be9daa36 | Triage™

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
koalahook-main/run.bat
Size 132B
Sample240419-2e441aab2t
SHA256 0b4e0a2047764e7f684296a48354c40d2efc3513fb323760a5f34a813d431628
MD5 1f310a4a6331c7be54ce42076c37c092
SHA1 a4da3b20a4bc0bb735c21ebf8534bf14f92526be
SHA512 3267ddc6602f24fce336f0299b95620d474572760cd3bc3870d392606d1b341d197e20b3dad689bd99393ebd0f63c63ac58cb977fba32cbb571bcc47cec32b6a
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Delays execution with timeout.exe 1 IoCs

pid	Process
1672	timeout.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 1672	756	cmd.exe	29
PID 756 wrote to memory of 1672	756	cmd.exe	29
PID 756 wrote to memory of 1672	756	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\koalahook-main\run.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:1672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads