cfce6a9841125af7c11ebc16cf4cfe5390451546036a76df8d717bd0e439ded9

Resubmissions

26-01-2025 21:39

250126-1hl7xswmdm 10

26-01-2025 21:30

250126-1cn5bsvkb1 10

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-01-2025 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PingReducer.exe
Size

7.6MB
MD5

7104e0e2fba92820b6cb2e9d151232e5
SHA1

5f04c8bcca632ec9d1b86280dd18a9d75378ac75
SHA256

cfce6a9841125af7c11ebc16cf4cfe5390451546036a76df8d717bd0e439ded9
SHA512

acdf3331714c544f7e9a012bf5d9755c8d6f32d6b8a583b3b63d95e877460ddaf4b12b97921d5addfbb31a15bcdd0d544ea5735db89f5bf3ddb470e37c5ad3c2
SSDEEP

196608:EJD+kdGviwfI9jUCBB7m+mKOY7rXrZusooDmhfvsbnTNW3:05IvhIHL7HmBYXrYoaUNI

Score

7^/10

discovery upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2572	PingReducer.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000500000001a067-21.dat	upx

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2704	PingReducer.exe
2572	PingReducer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2572	2704	PingReducer.exe	30
PID 2704 wrote to memory of 2572	2704	PingReducer.exe	30
PID 2704 wrote to memory of 2572	2704	PingReducer.exe	30

C:\Users\Admin\AppData\Local\Temp\PingReducer.exe
"C:\Users\Admin\AppData\Local\Temp\PingReducer.exe"
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Users\Admin\AppData\Local\Temp\PingReducer.exe
  "C:\Users\Admin\AppData\Local\Temp\PingReducer.exe"
  2⤵
  - Loads dropped DLL
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI27042\python313.dll

Filesize
1.8MB

MD5
9a3d3ae5745a79d276b05a85aea02549

SHA1
a5e60cac2ca606df4f7646d052a9c0ea813e7636

SHA256
09693bab682495b01de8a24c435ca5900e11d2d0f4f0807dae278b3a94770889

SHA512
46840b820ee3c0fa511596124eb364da993ec7ae1670843a15afd40ac63f2c61846434be84d191bd53f7f5f4e17fad549795822bb2b9c792ac22a1c26e5adf69

Download Submit
memory/2572-23-0x000007FEF6090000-0x000007FEF66F5000-memory.dmp

Filesize
6.4MB

Download