Analysis
-
max time kernel
2s -
max time network
95s -
platform
windows7_x64 -
resource
win7 -
submitted
29-06-2020 07:15
Static task
static1
Behavioral task
behavioral1
Sample
544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe
Resource
win7
0 signatures
0 seconds
General
-
Target
544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe
-
Size
1.5MB
-
MD5
0a383f6b665eb5e072773c9875d459cd
-
SHA1
aed86ee444beb6eddd188cc58f6e69430c1274ed
-
SHA256
544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e
-
SHA512
c93aefa7e61e379047dd967f5af0b57803b34228921037ea01893b40002ea079c7c57228b23e3770ff4c8d5c0ec175f58bd037a9f4fef8415a60308176437a9f
Score
8/10
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1076-34-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1076-39-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1076-40-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Suspicious use of SetThreadContext 2 IoCs
Processes:
544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exedescription pid process target process PID 1088 set thread context of 744 1088 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe svchost.exe PID 1088 set thread context of 1076 1088 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe 744 svchost.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exesvchost.exe544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exepid process 1088 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe 744 svchost.exe 1076 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exedescription pid process target process PID 1088 wrote to memory of 744 1088 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe svchost.exe PID 1088 wrote to memory of 744 1088 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe svchost.exe PID 1088 wrote to memory of 744 1088 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe svchost.exe PID 1088 wrote to memory of 744 1088 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe svchost.exe PID 1088 wrote to memory of 744 1088 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe svchost.exe PID 1088 wrote to memory of 744 1088 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe svchost.exe PID 1088 wrote to memory of 744 1088 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe svchost.exe PID 1088 wrote to memory of 744 1088 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe svchost.exe PID 1088 wrote to memory of 744 1088 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe svchost.exe PID 1088 wrote to memory of 744 1088 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe svchost.exe PID 1088 wrote to memory of 1076 1088 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe PID 1088 wrote to memory of 1076 1088 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe PID 1088 wrote to memory of 1076 1088 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe PID 1088 wrote to memory of 1076 1088 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe PID 1088 wrote to memory of 1076 1088 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe PID 1088 wrote to memory of 1076 1088 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe PID 1088 wrote to memory of 1076 1088 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe PID 1088 wrote to memory of 1076 1088 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe 544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe"C:\Users\Admin\AppData\Local\Temp\544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe"C:\Users\Admin\AppData\Local\Temp\544487e26be4ce2c8dc99409a7a46f9eadc1ac7aeaab59afdceeca319e1c1a9e.exe"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/744-31-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/744-33-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/744-35-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/744-32-0x000000000040B000-mapping.dmp
-
memory/1076-40-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1076-39-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1076-37-0x00000000004085D0-mapping.dmp
-
memory/1076-34-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1088-22-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1088-27-0x0000000000668000-0x0000000000669000-memory.dmpFilesize
4KB
-
memory/1088-12-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1088-13-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1088-16-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1088-17-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1088-18-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1088-19-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1088-2-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1088-23-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1088-24-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1088-25-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1088-26-0x0000000000668000-0x0000000000669000-memory.dmpFilesize
4KB
-
memory/1088-11-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1088-28-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1088-29-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1088-30-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1088-10-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1088-9-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1088-8-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1088-7-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1088-6-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1088-5-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1088-4-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB
-
memory/1088-3-0x0000000000666000-0x0000000000667000-memory.dmpFilesize
4KB