9df41ebe1a2c61bbc382a85a7788e127e4dafada4955a1b6c3dfcaf460bd714f | Triage

Resubmissions

09/07/2024, 13:39

240709-qydwdayanf 7

09/07/2024, 07:52

240709-jqdr3swdle 6

09/07/2024, 06:42

240709-hgkzcs1bjl 5

09/07/2024, 06:34

240709-hb2d6azhjn 3

09/07/2024, 05:47

240709-ggxgqa1crh 4

Analysis

max time kernel
114s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 05:47

Sharing

Report Analysis Logs

General

Target

net.exe
Size

80KB
MD5

bb1ae49b6b7c53499e94613761a6ac56
SHA1

76866dde54ee3fa5bc8efefb9d44e6bf859973aa
SHA256

afbe51517092256504f797f6a5abc02515a09d603e8c046ae31d7d7855568e91
SHA512

03e832e859915c3f17eec4205863383f23532892f69519fe604c15fcc855804608adabd0dbbda158307d9c009f88482633b24cb35c4ea85b7022fb638f6fc018
SSDEEP

1536:q++ViCmfVsRS+dFyRuyRaWqxkfDdR1dDNATmZF+:P+ViKnKfDD7DNATma

Score

1^/10

Malware Config

Signatures

Runs net.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 244	4544	net.exe	91
PID 4544 wrote to memory of 244	4544	net.exe	91

C:\Users\Admin\AppData\Local\Temp\net.exe
"C:\Users\Admin\AppData\Local\Temp\net.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1
  2⤵
  PID:244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads