01b6b1fef127398f9aae43f9dabc1cf8ddf5a4e50981347a6f26b4c9d6291b54 | Triage

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 07:42

Sharing

Report Analysis Logs

General

Target

bin/ping.bat
Size

263B
MD5

62a26811014559b839c885cd2ac31fa7
SHA1

b3fe62360fa6229b9d9da820c545d6c9fce8c215
SHA256

e3154b30109f1cbd15de5a40e641105ab4b2d0f648abfc94c21fdb32ffc0fe6d
SHA512

3f9b5fd6b40aea56077a2b55da0ac246d598070e2c10b3ec0a211375b1eddbcc39dded18fc68d73dc1146f2d01f37a882187eb624f20f0c639221c0c4f8b9ed2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 3016	1916	cmd.exe	29
PID 1916 wrote to memory of 3016	1916	cmd.exe	29
PID 1916 wrote to memory of 3016	1916	cmd.exe	29
PID 3016 wrote to memory of 2668	3016	java.exe	30
PID 3016 wrote to memory of 2668	3016	java.exe	30
PID 3016 wrote to memory of 2668	3016	java.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\bin\ping.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\system32\java.exe
  java -cp "C:\Users\Admin\AppData\Local\Temp"\nxd.jar;"C:\Users\Admin\AppData\Local\Temp"\lib\*; nxd.NxAdmin ping
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\system32\hostname.exe
    hostname
    3⤵
    PID:2668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3016-2-0x0000000002070000-0x00000000022E0000-memory.dmp

Filesize
2.4MB

Download
memory/3016-15-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/3016-16-0x0000000002070000-0x00000000022E0000-memory.dmp

Filesize
2.4MB

Download