bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b

General

Target

bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe
Size

254KB
MD5

6150e036fb07d67dd584d4f261ac7c96
SHA1

47619035c6fbdc03801580e8e8ec2d5a07f8ec0a
SHA256

bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b
SHA512

0915a914408145fbd064747550d2199d6718ebcd2a1b0dd11b4d8397c36f472f9bf7d9b40eb9beba5625213b05780362c58752054497bfa8080b4df24ccedda2

Score

5^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exebb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe

description	pid	process	target process
PID 316 set thread context of 1440	316	bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe	bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe

C:\Users\Admin\AppData\Local\Temp\bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe
"C:\Users\Admin\AppData\Local\Temp\bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:316

C:\Users\Admin\AppData\Local\Temp\bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe
"{path}"
2⤵
- Suspicious use of WriteProcessMemory
PID:1440

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
3⤵
PID:604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/604-3-0x0000000000000000-mapping.dmp

Download
memory/604-4-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/604-5-0x0000000000000000-mapping.dmp

Download
memory/1440-0-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/1440-1-0x0000000000405907-mapping.dmp

Download
memory/1440-2-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download

description	pid	process	target process
PID 316 wrote to memory of 1440	316	bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe	bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe
PID 316 wrote to memory of 1440	316	bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe	bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe
PID 316 wrote to memory of 1440	316	bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe	bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe
PID 316 wrote to memory of 1440	316	bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe	bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe
PID 316 wrote to memory of 1440	316	bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe	bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe
PID 316 wrote to memory of 1440	316	bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe	bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe
PID 316 wrote to memory of 1440	316	bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe	bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe
PID 316 wrote to memory of 1440	316	bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe	bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe
PID 316 wrote to memory of 1440	316	bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe	bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe
PID 316 wrote to memory of 1440	316	bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe	bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe
PID 316 wrote to memory of 1440	316	bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe	bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe
PID 316 wrote to memory of 1440	316	bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe	bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe
PID 1440 wrote to memory of 604	1440	bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe	cmd.exe
PID 1440 wrote to memory of 604	1440	bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe	cmd.exe
PID 1440 wrote to memory of 604	1440	bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe	cmd.exe
PID 1440 wrote to memory of 604	1440	bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe	cmd.exe
PID 1440 wrote to memory of 604	1440	bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe	cmd.exe
PID 1440 wrote to memory of 604	1440	bb3690b7a06dc269de8df9dfda9830876c57117c758c9f69720fc516daf7933b.exe	cmd.exe

Analysis

Sharing