Analysis
-
max time kernel
3s -
max time network
86s -
platform
windows7_x64 -
resource
win7 -
submitted
29-06-2020 07:16
Static task
static1
Behavioral task
behavioral1
Sample
a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe
Resource
win7
0 signatures
0 seconds
General
-
Target
a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe
-
Size
1.5MB
-
MD5
024031a11521b17f29263c4da1e3b575
-
SHA1
5889feced3e587271f4943ac487067734c9c8d93
-
SHA256
a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6
-
SHA512
04edd2e7e3565d1f8dbe9394bf7f4cb5010a1e9845a5068addb62dfce9b07d65f4e5f45361c4d88172067eb48871501d6881688c13148581474f7a185a80d3b6
Score
8/10
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1080-35-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1080-39-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1080-40-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Suspicious use of SetThreadContext 2 IoCs
Processes:
a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exedescription pid process target process PID 1324 set thread context of 1084 1324 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe svchost.exe PID 1324 set thread context of 1080 1324 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe 1084 svchost.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exesvchost.exea19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exepid process 1324 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe 1084 svchost.exe 1080 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exedescription pid process target process PID 1324 wrote to memory of 1084 1324 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe svchost.exe PID 1324 wrote to memory of 1084 1324 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe svchost.exe PID 1324 wrote to memory of 1084 1324 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe svchost.exe PID 1324 wrote to memory of 1084 1324 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe svchost.exe PID 1324 wrote to memory of 1084 1324 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe svchost.exe PID 1324 wrote to memory of 1084 1324 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe svchost.exe PID 1324 wrote to memory of 1084 1324 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe svchost.exe PID 1324 wrote to memory of 1084 1324 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe svchost.exe PID 1324 wrote to memory of 1084 1324 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe svchost.exe PID 1324 wrote to memory of 1084 1324 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe svchost.exe PID 1324 wrote to memory of 1080 1324 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe PID 1324 wrote to memory of 1080 1324 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe PID 1324 wrote to memory of 1080 1324 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe PID 1324 wrote to memory of 1080 1324 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe PID 1324 wrote to memory of 1080 1324 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe PID 1324 wrote to memory of 1080 1324 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe PID 1324 wrote to memory of 1080 1324 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe PID 1324 wrote to memory of 1080 1324 a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe"C:\Users\Admin\AppData\Local\Temp\a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe"C:\Users\Admin\AppData\Local\Temp\a19bd6d9d1b12fddf50610ae88da3a2d3bb99e5ce1013cbe08b1289bae48f5e6.exe"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1080-40-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1080-39-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1080-37-0x00000000004085D0-mapping.dmp
-
memory/1080-35-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1084-31-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1084-33-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1084-34-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1084-32-0x000000000040B000-mapping.dmp
-
memory/1324-22-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1324-27-0x0000000000738000-0x0000000000739000-memory.dmpFilesize
4KB
-
memory/1324-12-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1324-13-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1324-16-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1324-17-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1324-18-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1324-19-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1324-2-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1324-23-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1324-24-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1324-25-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1324-26-0x0000000000738000-0x0000000000739000-memory.dmpFilesize
4KB
-
memory/1324-11-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1324-28-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1324-29-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1324-30-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1324-10-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1324-9-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1324-8-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1324-7-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1324-6-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1324-5-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1324-4-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB
-
memory/1324-3-0x0000000000736000-0x0000000000737000-memory.dmpFilesize
4KB