15082d63b8d260ab182000b054b43679961bb1086ea8fdfdd53833e6148b3c55

Analysis

max time kernel
94s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-09-2024 07:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Flexlm/RLM_Redshift_LicServer/start_rlm_Redshift.bat
Size

980B
MD5

25300a269b8dd5c89876495ef98088cb
SHA1

0131acd6ef015b165b29dd3bf488011eae74dc8f
SHA256

0920c2445e2af510161894d000726dc9e0dc2b1df90bc10184fd09a92eb68ec9
SHA512

4ad63a12be7f235d0991844ddd125bc2001e7a6bb66daa2205676a49a8c5d9d904e49526da4a53bf341a1a98fd5895eb3e6bd51309e1b79ac0d504fa19c0eb71

Score

5^/10

discovery

Malware Config

Signatures

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
1156	tasklist.exe

Runs .reg file with regedit 1 IoCs

pid	Process
5004	regedit.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1156	tasklist.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 1156	3048	cmd.exe	86
PID 3048 wrote to memory of 1156	3048	cmd.exe	86
PID 3048 wrote to memory of 1576	3048	cmd.exe	87
PID 3048 wrote to memory of 1576	3048	cmd.exe	87
PID 3048 wrote to memory of 5004	3048	cmd.exe	89
PID 3048 wrote to memory of 5004	3048	cmd.exe	89
PID 3048 wrote to memory of 3056	3048	cmd.exe	90
PID 3048 wrote to memory of 3056	3048	cmd.exe	90
PID 3056 wrote to memory of 1644	3056	net.exe	91
PID 3056 wrote to memory of 1644	3056	net.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Flexlm\RLM_Redshift_LicServer\start_rlm_Redshift.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1156
- C:\Windows\system32\find.exe
  find /i "CGHotman_Redshift_Server.exe"
  2⤵
  PID:1576
- C:\Windows\regedit.exe
  regedit /s C:\Flexlm\RLM_Redshift_LicServer\Redshift_firewall.reg
  2⤵
  - Runs .reg file with regedit
  PID:5004
- C:\Windows\system32\net.exe
  C:\Windows\system32\net start RLM-Redshift
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start RLM-Redshift
    3⤵
    PID:1644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads