Analysis
-
max time kernel
3s -
max time network
137s -
platform
windows7_x64 -
resource
win7 -
submitted
29-06-2020 07:16
Static task
static1
Behavioral task
behavioral1
Sample
861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe
Resource
win7
0 signatures
0 seconds
General
-
Target
861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe
-
Size
1.5MB
-
MD5
1c72f2ac3f8aedcb677d1843030402e2
-
SHA1
0b4a2c3e4c919c95c2543eaad8bb8e207fede04c
-
SHA256
861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471
-
SHA512
0532968f04a30cf7e63f95d6bcbd13a8a59ea13afefd8987aba2811f22c0995adabff33773b335933ea8064aeebdb83af4168bf6f75940d8ea1130c59a6e38f4
Score
8/10
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1528-34-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1528-37-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1528-39-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Suspicious use of SetThreadContext 2 IoCs
Processes:
861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exedescription pid process target process PID 316 set thread context of 1060 316 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe svchost.exe PID 316 set thread context of 1528 316 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe 1060 svchost.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exesvchost.exe861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exepid process 316 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe 1060 svchost.exe 1528 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exedescription pid process target process PID 316 wrote to memory of 1060 316 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe svchost.exe PID 316 wrote to memory of 1060 316 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe svchost.exe PID 316 wrote to memory of 1060 316 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe svchost.exe PID 316 wrote to memory of 1060 316 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe svchost.exe PID 316 wrote to memory of 1060 316 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe svchost.exe PID 316 wrote to memory of 1060 316 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe svchost.exe PID 316 wrote to memory of 1060 316 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe svchost.exe PID 316 wrote to memory of 1060 316 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe svchost.exe PID 316 wrote to memory of 1060 316 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe svchost.exe PID 316 wrote to memory of 1060 316 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe svchost.exe PID 316 wrote to memory of 1528 316 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe PID 316 wrote to memory of 1528 316 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe PID 316 wrote to memory of 1528 316 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe PID 316 wrote to memory of 1528 316 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe PID 316 wrote to memory of 1528 316 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe PID 316 wrote to memory of 1528 316 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe PID 316 wrote to memory of 1528 316 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe PID 316 wrote to memory of 1528 316 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe 861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe"C:\Users\Admin\AppData\Local\Temp\861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe"C:\Users\Admin\AppData\Local\Temp\861612023a39c17395fc19e69d4dea9af52cafdba0bdf9ce301268f5c0284471.exe"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/316-22-0x00000000009E6000-0x00000000009E7000-memory.dmpFilesize
4KB
-
memory/316-9-0x00000000009E6000-0x00000000009E7000-memory.dmpFilesize
4KB
-
memory/316-4-0x00000000009E6000-0x00000000009E7000-memory.dmpFilesize
4KB
-
memory/316-2-0x00000000009E6000-0x00000000009E7000-memory.dmpFilesize
4KB
-
memory/316-6-0x00000000009E6000-0x00000000009E7000-memory.dmpFilesize
4KB
-
memory/316-7-0x00000000009E6000-0x00000000009E7000-memory.dmpFilesize
4KB
-
memory/316-8-0x00000000009E6000-0x00000000009E7000-memory.dmpFilesize
4KB
-
memory/316-23-0x00000000009E6000-0x00000000009E7000-memory.dmpFilesize
4KB
-
memory/316-10-0x00000000009E6000-0x00000000009E7000-memory.dmpFilesize
4KB
-
memory/316-11-0x00000000009E6000-0x00000000009E7000-memory.dmpFilesize
4KB
-
memory/316-12-0x00000000009E6000-0x00000000009E7000-memory.dmpFilesize
4KB
-
memory/316-13-0x00000000009E6000-0x00000000009E7000-memory.dmpFilesize
4KB
-
memory/316-16-0x00000000009E6000-0x00000000009E7000-memory.dmpFilesize
4KB
-
memory/316-24-0x00000000009E6000-0x00000000009E7000-memory.dmpFilesize
4KB
-
memory/316-18-0x00000000009E6000-0x00000000009E7000-memory.dmpFilesize
4KB
-
memory/316-19-0x00000000009E6000-0x00000000009E7000-memory.dmpFilesize
4KB
-
memory/316-5-0x00000000009E6000-0x00000000009E7000-memory.dmpFilesize
4KB
-
memory/316-3-0x00000000009E6000-0x00000000009E7000-memory.dmpFilesize
4KB
-
memory/316-17-0x00000000009E6000-0x00000000009E7000-memory.dmpFilesize
4KB
-
memory/316-25-0x00000000009E6000-0x00000000009E7000-memory.dmpFilesize
4KB
-
memory/316-26-0x00000000009E8000-0x00000000009E9000-memory.dmpFilesize
4KB
-
memory/316-27-0x00000000009E8000-0x00000000009E9000-memory.dmpFilesize
4KB
-
memory/316-28-0x00000000009E6000-0x00000000009E7000-memory.dmpFilesize
4KB
-
memory/316-29-0x00000000009E6000-0x00000000009E7000-memory.dmpFilesize
4KB
-
memory/316-30-0x00000000009E6000-0x00000000009E7000-memory.dmpFilesize
4KB
-
memory/1060-31-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1060-32-0x000000000040B000-mapping.dmp
-
memory/1060-33-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1060-36-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1528-34-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1528-35-0x00000000004085D0-mapping.dmp
-
memory/1528-37-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1528-39-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB