21c3dda1705a30f4d677e8bfbda332ca184e75fa377bf83e64e579209f360962

Analysis

max time kernel
141s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 20:42

Target

AcrylicConsole.exe
Size

445KB
MD5

7cc20e36ce5992ac1d41a4719c9a6e31
SHA1

941900adfd85a1823a2f58ae15b76036a4862ed3
SHA256

10b65511903694caebdc48a6301912d6e220e1101528800fca18db6b48f515f4
SHA512

b14edb1bd0ded697adeb81e6b4739289ad101bfc72ef5a52e25d4cb486ade667958bcd5f89da2ffdf9d10021f4d5e878608cb0e241e6ea1cad7f9afb7490ec2a
SSDEEP

12288:M+vnuCQI8OPfzFqOTRQxai1DeIHngCtf:MI/QqqOl4nlQCZ

Score

1^/10

Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

IpConfig.exe

pid process

4868 IpConfig.exe

pid	process
4868	IpConfig.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

AcrylicConsole.exe

description	pid	process	target process
PID 1244 wrote to memory of 4868	1244	AcrylicConsole.exe	IpConfig.exe
PID 1244 wrote to memory of 4868	1244	AcrylicConsole.exe	IpConfig.exe
PID 1244 wrote to memory of 4868	1244	AcrylicConsole.exe	IpConfig.exe

C:\Users\Admin\AppData\Local\Temp\AcrylicConsole.exe
"C:\Users\Admin\AppData\Local\Temp\AcrylicConsole.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1244

C:\Windows\SysWOW64\IpConfig.exe
IpConfig.exe /All
2⤵
- Gathers network information
PID:4868

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1244-3-0x0000000000400000-0x0000000000776000-memory.dmp

Filesize
3.5MB

Download