d9c6ba096bc85554d5e3adff83edb5c97c179bd28f21bff3c4969786be9daa36 | Triage

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 22:30

Sharing

Report Analysis Logs

General

Target

koalahook-main/run.bat
Size

132B
MD5

1f310a4a6331c7be54ce42076c37c092
SHA1

a4da3b20a4bc0bb735c21ebf8534bf14f92526be
SHA256

0b4e0a2047764e7f684296a48354c40d2efc3513fb323760a5f34a813d431628
SHA512

3267ddc6602f24fce336f0299b95620d474572760cd3bc3870d392606d1b341d197e20b3dad689bd99393ebd0f63c63ac58cb977fba32cbb571bcc47cec32b6a

Score

1^/10

Malware Config

Signatures

Delays execution with timeout.exe 1 IoCs

pid	Process
1244	timeout.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 1244	2896	cmd.exe	29
PID 2896 wrote to memory of 1244	2896	cmd.exe	29
PID 2896 wrote to memory of 1244	2896	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\koalahook-main\run.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:1244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads