a43e9d152796855e2d736ddfa8f65332ae1b4b8be8cd6592ecef9c9ab9ca2394 | Triage

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 01:38

Sharing

Report Analysis Logs

General

Target

core.bat
Size

116B
MD5

f5b21b76543e9d9e0266907eba908086
SHA1

cc36e63f29e87b8fb761cb522e5dcf67260ede59
SHA256

12798db160501db81306c6cca0ab2304a1b7222da6ec99f0ccbdb67dcf442660
SHA512

6908cf93c848c4f4a1ade20bbba17e8f0e7af788d8d2de342b56dcee240f03ab88aeb4cb453fb3630bb885bac701e48e0cbcc721e393acef41cb163eaadb0ab3

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1612	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1612	rundll32.exe
1612	rundll32.exe
1612	rundll32.exe
1612	rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 1612	2684	cmd.exe	86
PID 2684 wrote to memory of 1612	2684	cmd.exe	86

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\core.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\vessel-64.dat,DllMain /i="license.dat"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1612-2-0x00007FF976865000-0x00007FF976AE8000-memory.dmp

Filesize
2.5MB

Download
memory/1612-3-0x00007FF9943D0000-0x00007FF9943D2000-memory.dmp

Filesize
8KB

Download