d9c6ba096bc85554d5e3adff83edb5c97c179bd28f21bff3c4969786be9daa36 | Triage™

Analysis

max time kernel
140s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
koalahook-main/run.bat
Size 132B
Sample240419-2e441aab2t
SHA256 0b4e0a2047764e7f684296a48354c40d2efc3513fb323760a5f34a813d431628
MD5 1f310a4a6331c7be54ce42076c37c092
SHA1 a4da3b20a4bc0bb735c21ebf8534bf14f92526be
SHA512 3267ddc6602f24fce336f0299b95620d474572760cd3bc3870d392606d1b341d197e20b3dad689bd99393ebd0f63c63ac58cb977fba32cbb571bcc47cec32b6a
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Delays execution with timeout.exe 1 IoCs

pid	Process
1288	timeout.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 1288	3040	cmd.exe	87
PID 3040 wrote to memory of 1288	3040	cmd.exe	87

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\koalahook-main\run.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:1288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads