894a461e0d709023ba6ec45f748b38a79ae12cf398702244ef2ffa93dd644133

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adab89a1b7da6ae4c96646563b0c506f.exe
Size

7KB
MD5

adab89a1b7da6ae4c96646563b0c506f
SHA1

b20a04b6783bb1084b11db58fac6c8b212109717
SHA256

9804ead50696e545955543c470bdbbe3859f714278acc47e3c9c2a092ddd9b2d
SHA512

2905df01b7e30a2d1bcac38e7d02d97494854bfb3d5412e79b758a21f439436c984f312d6a5c78cd47d40df7f4402582cf6a20b1686f693c21e11920b59b2190
SSDEEP

192:/LecMoaS0KtNdaLix8qiG/VunlYJLLLTu6n2qS+:/LecMoaSjzdaLiYOhPLTu6zS

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2904	2764	adab89a1b7da6ae4c96646563b0c506f.exe	31
PID 2764 wrote to memory of 2904	2764	adab89a1b7da6ae4c96646563b0c506f.exe	31
PID 2764 wrote to memory of 2904	2764	adab89a1b7da6ae4c96646563b0c506f.exe	31
PID 2904 wrote to memory of 2832	2904	cmd.exe	33
PID 2904 wrote to memory of 2832	2904	cmd.exe	33
PID 2904 wrote to memory of 2832	2904	cmd.exe	33
PID 2832 wrote to memory of 2400	2832	net.exe	34
PID 2832 wrote to memory of 2400	2832	net.exe	34
PID 2832 wrote to memory of 2400	2832	net.exe	34

C:\Users\Admin\AppData\Local\Temp\adab89a1b7da6ae4c96646563b0c506f.exe
"C:\Users\Admin\AppData\Local\Temp\adab89a1b7da6ae4c96646563b0c506f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\cmd.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Windows\system32\net.exe
    net user Admin *
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user Admin *
      4⤵
      PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cmd.bat

Filesize
189B

MD5
f2fdc4b2ed14c03566adab02abadc89e

SHA1
bc16324ab27ad25516b3db42d6e915d9b6d029cf

SHA256
82f36254f9ba3303a7c1a5f58b69532096afef76e21b2f35d18e00938513d525

SHA512
385e516376dc164e7a370ba1c94b1b06d354a294ecfdcd95dd9527f135a81ff90bcb92d34537f60499f9804b04848928a2f300ec6cbde288d2364e90ef2e733f

Download Submit
memory/2764-0-0x000007FEF58C3000-0x000007FEF58C4000-memory.dmp

Filesize
4KB

Download
memory/2764-1-0x00000000001D0000-0x00000000001D8000-memory.dmp

Filesize
32KB

Download