Analysis
- max time kernel
6s - max time network
10s - platform
windows7_x64 - resource
win7-20241010-en - resource tags
- submitted
04/11/2024, 06:38
General
- Target Application.bat
- Size 6KB
- Sample241104-heflvswhlr
- SHA256 0f31042be5c136b8e937138dd205f55d9bd6d7a005ec2b385d1f3818ee2e37fc
Malware Config
Signatures
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Application.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lua.exelua.exe cache.txt2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Cab314F.tmp
Tar321D.tmp
memory/2548-10-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-63-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-11-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-62-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-61-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-60-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-59-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-19-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-50-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-49-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-48-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-47-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-46-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-45-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-44-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-43-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-42-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-52-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-84-0x00000000001F0000-0x00000000001F1000-memory.dmp
memory/2548-41-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-40-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-39-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-38-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-37-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-36-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-34-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-33-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-32-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-31-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-30-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-29-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-28-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-27-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-26-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-25-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-24-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-23-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-22-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-21-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-20-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-18-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-17-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-16-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-58-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-57-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-56-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-55-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-54-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-53-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-51-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-35-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-15-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-14-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-13-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-12-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-9-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-8-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-7-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-6-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-5-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-4-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-3-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-2-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-1-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/2548-0-0x000000007EFA0000-0x000000007EFB0000-memory.dmp