0b330cbb4fe9a4d74c91ff3be997be695b957c3ddac6351dacc2574ba5d7b276 | Triage™

Analysis

max time kernel
92s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
点此使用【配置文件】启动.bat
Size 87B
Sample240608-rt43facd9t
SHA256 8e4cadc89ab953905bfe25e83de227debc5ae947d0a9580a769ba2f54ada96a7
MD5 e2596e65a2213cae62db6a60c29dfa21
SHA1 87c805a4d4f4d85b981d5746c88ee20f756b1659
SHA512 b3d8526f3d1074d8248f980872731a5b5ccbccd6924f08063cb601b3717dcaa3510867ea2624f5a32f574d0d07308bb46743801256b98fb25b305d83994d559b
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4936	frpc.exe
4936	frpc.exe
4936	frpc.exe
4936	frpc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 4936	1148	cmd.exe	81
PID 1148 wrote to memory of 4936	1148	cmd.exe	81
PID 1148 wrote to memory of 4936	1148	cmd.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\点此使用【配置文件】启动.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Users\Admin\AppData\Local\Temp\frpc.exe
  .\frpc.exe -c frpc.ini
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads