94afeea2bb5e4f71130dcf04a6f94fa083c70cfd32803fdf0df9e608ee04e13a

General

Target
94afeea2bb5e4f71130dcf04a6f94fa083c70cfd32803fdf0df9e608ee04e13a.exe
Size 1.5MB
Sample260723-qcaa3azbmd
SHA256 94afeea2bb5e4f71130dcf04a6f94fa083c70cfd32803fdf0df9e608ee04e13a
MD5 a2df5576215f117fab93456b18968890
SHA1 c344f903af49afc3766ee0de6419bc587ffeea1f
SHA512 2ad3b1921f9a29525bba5d3a48c22a4b803b373ff3940222221e0d6f65f029b517f96f9f9ac309767dcbc65b1d99961f6bf8a929d8a06537c7c8f8d5e89e0270
SSDEEP 12288:y4gjskV8JPiME/lspl2aQMoMOAPqQBnEC+/12SpOoqiXhyqbvTqMXkEOAxS5:ylsTE/lspJ+/1Aocqb37JxS
TLSH
T1FE75A54BEBB650D1F5BAC139D552223AFC723CA1873897D792856A0A1B30FE4AD7D700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2612	cmd.exe
1680	cmd.exe
5932	cmd.exe
3348	cmd.exe
3344	cmd.exe
5588	cmd.exe
4548	cmd.exe
4420	cmd.exe
3352	cmd.exe
3432	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4976	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1852	powershell.exe
1852	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1852	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 3348	4620	94afeea2bb5e4f71130dcf04a6f94fa083c70cfd32803fdf0df9e608ee04e13a.exe	90
PID 4620 wrote to memory of 3344	4620	94afeea2bb5e4f71130dcf04a6f94fa083c70cfd32803fdf0df9e608ee04e13a.exe	91
PID 4620 wrote to memory of 5588	4620	94afeea2bb5e4f71130dcf04a6f94fa083c70cfd32803fdf0df9e608ee04e13a.exe	92
PID 4620 wrote to memory of 3352	4620	94afeea2bb5e4f71130dcf04a6f94fa083c70cfd32803fdf0df9e608ee04e13a.exe	93
PID 4620 wrote to memory of 3432	4620	94afeea2bb5e4f71130dcf04a6f94fa083c70cfd32803fdf0df9e608ee04e13a.exe	94
PID 4620 wrote to memory of 4548	4620	94afeea2bb5e4f71130dcf04a6f94fa083c70cfd32803fdf0df9e608ee04e13a.exe	95
PID 4548 wrote to memory of 1852	4548	cmd.exe	96
PID 4548 wrote to memory of 3456	4548	cmd.exe	97
PID 4548 wrote to memory of 5912	4548	cmd.exe	98
PID 4548 wrote to memory of 5292	4548	cmd.exe	99
PID 4620 wrote to memory of 2612	4620	94afeea2bb5e4f71130dcf04a6f94fa083c70cfd32803fdf0df9e608ee04e13a.exe	100
PID 4620 wrote to memory of 4420	4620	94afeea2bb5e4f71130dcf04a6f94fa083c70cfd32803fdf0df9e608ee04e13a.exe	101
PID 4420 wrote to memory of 4976	4420	cmd.exe	102
PID 4620 wrote to memory of 1680	4620	94afeea2bb5e4f71130dcf04a6f94fa083c70cfd32803fdf0df9e608ee04e13a.exe	103
PID 4620 wrote to memory of 5932	4620	94afeea2bb5e4f71130dcf04a6f94fa083c70cfd32803fdf0df9e608ee04e13a.exe	104

C:\Users\Admin\AppData\Local\Temp\94afeea2bb5e4f71130dcf04a6f94fa083c70cfd32803fdf0df9e608ee04e13a.exe
"C:\Users\Admin\AppData\Local\Temp\94afeea2bb5e4f71130dcf04a6f94fa083c70cfd32803fdf0df9e608ee04e13a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c title FreeDownloader
  2⤵
  - Executes a command shell one-liner
  PID:3348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mkdir Downloads
  2⤵
  - Executes a command shell one-liner
  PID:3344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mkdir config
  2⤵
  - Executes a command shell one-liner
  PID:5588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mkdir cookies
  2⤵
  - Executes a command shell one-liner
  PID:3352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mkdir temp
  2⤵
  - Executes a command shell one-liner
  PID:3432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell [guid]::NewGuid() | find /v "Guid" | find /v "--" | find "-" > config\uuid
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell [guid]::NewGuid()
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1852
- - C:\Windows\system32\find.exe
    find /v "Guid"
    3⤵
    PID:3456
- - C:\Windows\system32\find.exe
    find /v "--"
    3⤵
    PID:5912
- - C:\Windows\system32\find.exe
    find "-"
    3⤵
    PID:5292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color 0B
  2⤵
  - Executes a command shell one-liner
  PID:2612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c TIMEOUT /T 2 > nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Windows\system32\timeout.exe
    TIMEOUT /T 2
    3⤵
    - Delays execution with timeout.exe
    PID:4976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color 0B
  2⤵
  - Executes a command shell one-liner
  PID:1680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:5932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

uuid

Path C:\Users\Admin\AppData\Local\Temp\config\uuid
Size 38B
SHA256 002af1efe6424b55c9c310d354c3b731d202d567147ef036ba3478838f298610
MD5 efa5fcd33cf2ee8a6f5185d1c5aa6b2b
SHA1 e1e74be477173d554d9593c39a7cd17ab2f335d5
SHA512 a20664d824a1f75a6315269b246a65db672acf2684ce23af62392dac9a0b4071571bd242e7d8c409ed6e8ccaab73bec9e44c004b276ed721556c7448a4afdd36
MD5 SHA1 SHA512

Submit Download

memory/1852-1-0x00007FFB28A7F000-0x00007FFB28A80000-memory.dmp

Download

memory/1852-4-0x0000021EDDDB0000-0x0000021EDDDD2000-memory.dmp

Download

memory/1852-5-0x00007FFB288F0000-0x00007FFB29294000-memory.dmp

Download

memory/1852-6-0x00007FFB288F0000-0x00007FFB29294000-memory.dmp

Download

memory/1852-8-0x00007FFB288F0000-0x00007FFB29294000-memory.dmp

Download

memory/4620-0-0x00007FF74CD10000-0x00007FF74CF32000-memory.dmp

Download

memory/4620-11-0x00007FF74CD10000-0x00007FF74CF32000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads