Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
14-06-2024 01:38
Static task
static1
Behavioral task
behavioral1
Sample
6438/8157.cmd
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
6438/8157.cmd
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
6438/plugged.dll
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
6438/plugged.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
Overdue.lnk
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
Overdue.lnk
Resource
win10v2004-20240508-en
General
-
Target
6438/8157.cmd
-
Size
275B
-
MD5
533d29a067a011b9115e4fcbc94305d7
-
SHA1
1ff3aa4f90e4933ebfe20e1398dc22ecf8a2e771
-
SHA256
7bad03aef5b3d3c66dd5a4ed8a82d18643e90536b963e0711611e3266f24d054
-
SHA512
01d8fc83062dd83e15d3345e2463c6161c052e50a9cfe416de0f7ed569cc02cd63c091f5537ad0ceedf7414cad74ccbd96ab732587b873dd7152c6faadaf5d00
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
re.exepid process 2300 re.exe 1248 -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 2468 cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
cmd.exedescription pid process target process PID 2468 wrote to memory of 2412 2468 cmd.exe PING.EXE PID 2468 wrote to memory of 2412 2468 cmd.exe PING.EXE PID 2468 wrote to memory of 2412 2468 cmd.exe PING.EXE PID 2468 wrote to memory of 2300 2468 cmd.exe re.exe PID 2468 wrote to memory of 2300 2468 cmd.exe re.exe PID 2468 wrote to memory of 2300 2468 cmd.exe re.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\6438\8157.cmd"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping 127.0.0.12⤵
- Runs ping.exe
-
\??\c:\users\public\re.exec:\\users\\public\\re.exe 6438\plugged.dat2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Public\re.exeFilesize
19KB
MD559bce9f07985f8a4204f4d6554cff708
SHA1645c424974fbe5fe7a04cac73f1c23c96e1570b8
SHA256ca24aef558647274d019dfb4d7fd1506d84ec278795c30ba53b81bb36130dc57
SHA5123cf5825a9c7fb80ea0bd36775a92d07f34cd3709ed2c7c8f500f1c8baa5242768f6d575bd2477b77e3f177e7a4994d5c5bddb24c6eb43b60a6bd83ea026a8198
-
memory/2300-6-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB