dd7654e31781d29cc24000a7a00c6ad849adbb4cedb82f3bd53e1eb595231843 | Triage

Analysis

max time kernel
106s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
26-10-2024 18:02

Sharing

Report Analysis Logs

General

Target

BadZone SCP_SL/RUS/start.bat
Size

62B
MD5

019b6ed1cbc0b959f60079a7f37fb2dd
SHA1

3ce5de167d13e8835b8a40017a80840c906fe075
SHA256

b12c2d340a4df769f2e21496d29e510e662764b5c4086c4d29da436a792dd9a6
SHA512

748a5d6949bb5d86099c2bc860681565e05bd7e9668d5648d0ae70b1676d80e431efd40105493db5c34d4a112cbba24af1abec46bee5456ff375f6fdf0497572

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Injector.exe

pid	process
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe
3708	Injector.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 1888 wrote to memory of 3708 1888 cmd.exe Injector.exe
PID 1888 wrote to memory of 3708 1888 cmd.exe Injector.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\BadZone SCP_SL\RUS\start.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1888

C:\Users\Admin\AppData\Local\Temp\BadZone SCP_SL\RUS\Injector.exe
Injector.exe LokiSCPSL.dll SCPSL.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads