5fbd4e2c42e19e7ee561183ca6b2ded2f8049a890951704c799e8b4a016ab817 | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-11-2024 23:43

Sharing

Report Analysis Logs

General

Target

BotKiller.exe
Size

6KB
MD5

10d199b2efdb69ed343f5cd4044b7def
SHA1

1f218983db04d9b7b31a67aeead5a94ca5d3dc80
SHA256

5fbd4e2c42e19e7ee561183ca6b2ded2f8049a890951704c799e8b4a016ab817
SHA512

682feb271c12a847b69f1ac92ad7d5cad18b145b64af83dbe7fd0f6282be8bf6091323ca16bc509f789a68e74e17eb1484fce907f9a0562237b40572e0e8852c
SSDEEP

96:1SJmM+BVOGjYKyhp+Aloz0yD/TB2uJW9wzNt:1smHOhpdXyLEuJIS

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

BotKiller.exe

pid	Process
2148	BotKiller.exe
2148	BotKiller.exe
2148	BotKiller.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

BotKiller.exe

description	pid	Process
Token: SeDebugPrivilege	2148	BotKiller.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

BotKiller.exe

description	pid	Process	procid_target
PID 2148 wrote to memory of 2364	2148	BotKiller.exe	31
PID 2148 wrote to memory of 2364	2148	BotKiller.exe	31
PID 2148 wrote to memory of 2364	2148	BotKiller.exe	31

C:\Users\Admin\AppData\Local\Temp\BotKiller.exe
"C:\Users\Admin\AppData\Local\Temp\BotKiller.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2148 -s 1072
  2⤵
  PID:2364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2148-0-0x000007FEF55B3000-0x000007FEF55B4000-memory.dmp

Filesize
4KB

Download
memory/2148-1-0x000000013FB20000-0x000000013FB26000-memory.dmp

Filesize
24KB

Download
memory/2148-2-0x000007FEF55B0000-0x000007FEF5F9C000-memory.dmp

Filesize
9.9MB

Download
memory/2148-3-0x000007FEF55B0000-0x000007FEF5F9C000-memory.dmp

Filesize
9.9MB

Download