edc8f9c1c831cd44133bec7bca9599cc380965a9e5524f55436cf7b2db38b86c

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06-08-2024 15:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Vixen.exe
Size

3.2MB
MD5

2d414037a4dc5b644ad6f795b113d59b
SHA1

dc744f08f981d60267b929f64787c7e47626bd87
SHA256

edc8f9c1c831cd44133bec7bca9599cc380965a9e5524f55436cf7b2db38b86c
SHA512

d4047b51709798ae6bfc0dd331e8975d117ebd60ab4d2d23234c14f481300b558f042596151fd4715d446a323090533c10a61809fe25f37ab9b6b432222b32c3
SSDEEP

49152:CRfGtlqbIU6i1Zmzj03Ch3RX3NzjK1iRIxYyYh++LXQFeEy5UDkPS2NPoI5TjnbK:2G+S0Sh3RX9zOGvx51a2mI

Score

3^/10

discovery

Malware Config

Signatures

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2556	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 2556	1420	Vixen.exe	31
PID 1420 wrote to memory of 2556	1420	Vixen.exe	31
PID 1420 wrote to memory of 2556	1420	Vixen.exe	31

C:\Users\Admin\AppData\Local\Temp\Vixen.exe
"C:\Users\Admin\AppData\Local\Temp\Vixen.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REM if u epic employee, pls stop raping my fun exploits and please unban my false banned main cus ur support is too shit thanks man ;3
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1420-0-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download