2eb959e06c121bd6ea9e5cc6edb280aca21344837f653660f5c97b46efb97793

Analysis

max time kernel
97s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 12:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Installer.bat
Size

544B
MD5

17033b44988e812ebade9022cba3584f
SHA1

3c98c9f36212cfeec679057cabb1ea5d4bffb1a1
SHA256

deda21bef6613c01484a7c219070f1c510d96a31373a9561e31a8e45b3c94473
SHA512

9f54c72cafeedb4b332e8c4d438e88475d1757ea4ffdf23d13d0f1bae55806b3fe58cf48002085f5a867c5d8906c4b7674584c4070288e35026037cdc33eb282

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 4484	1192	cmd.exe	84
PID 1192 wrote to memory of 4484	1192	cmd.exe	84
PID 1192 wrote to memory of 1172	1192	cmd.exe	85
PID 1192 wrote to memory of 1172	1192	cmd.exe	85
PID 1192 wrote to memory of 1172	1192	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Installer.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:4484
- C:\Users\Admin\AppData\Local\Temp\compiler.exe
  compiler.exe config
  2⤵
  PID:1172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1172-6-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-25-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-63-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-62-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-61-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-60-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-59-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-58-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-56-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-55-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-54-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-53-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-52-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-51-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-188-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Filesize
4KB

Download
memory/1172-50-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-49-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-48-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-47-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-46-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-45-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-44-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-43-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-42-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-41-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-40-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-39-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-38-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-37-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-36-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-35-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-34-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-33-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-32-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-31-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-30-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-29-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-28-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-27-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-26-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-24-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-23-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-22-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-21-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-20-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-19-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-18-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-17-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-16-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-15-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-14-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-13-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-12-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-11-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-10-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-9-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-8-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-7-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-57-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-5-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-4-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-3-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-2-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-1-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download
memory/1172-0-0x000000007F510000-0x000000007F520000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads