bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4

General

Target

bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe
Size

3.0MB
MD5

d149b481ff1994a5d7a3229e1b15ee9b
SHA1

0fd8d900b9a357c189427ad1cde7061f1c75a412
SHA256

bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4
SHA512

992bc2de91c88d22cacfe405e471b7670f9bc54021e7c8dfb1b94a4500871d5dc7b2a7de7b2f34c3c84e11c798929b629b9b2162ae0cf30a6235a56bb0d25ad9

Score

7^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe

pid process

1448 bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe

pid	process
1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe
1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe
1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe
1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe
1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe
1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe
1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe
1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe
1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe
1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe
1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe
1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe
1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe
1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe
1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe
1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe
1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe
1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe
1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe
1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe

description	pid	process	target process
PID 1448 wrote to memory of 1096	1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe	calc.exe
PID 1448 wrote to memory of 1096	1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe	calc.exe
PID 1448 wrote to memory of 1096	1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe	calc.exe
PID 1448 wrote to memory of 1096	1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe	calc.exe
PID 1448 wrote to memory of 1096	1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe	calc.exe
PID 1448 wrote to memory of 1096	1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe	calc.exe
PID 1448 wrote to memory of 1096	1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe	calc.exe
PID 1448 wrote to memory of 1096	1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe	calc.exe
PID 1448 wrote to memory of 1096	1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe	calc.exe
PID 1448 wrote to memory of 1096	1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe	calc.exe
PID 1448 wrote to memory of 1096	1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe	calc.exe
PID 1448 wrote to memory of 1096	1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe	calc.exe
PID 1448 wrote to memory of 1096	1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe	calc.exe
PID 1448 wrote to memory of 1096	1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe	calc.exe
PID 1448 wrote to memory of 1096	1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe	calc.exe
PID 1448 wrote to memory of 1096	1448	bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe	calc.exe

Drops startup file 1 IoCs

Processes:

DllHost.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\soundbuster.exe DllHost.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\soundbuster.exe	DllHost.exe

C:\Users\Admin\AppData\Local\Temp\bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe
"C:\Users\Admin\AppData\Local\Temp\bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1448

C:\Windows\SysWOW64\calc.exe
"C:\Users\Admin\AppData\Local\Temp\bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4.exe"
2⤵
PID:1096

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}
1⤵
- Drops startup file
PID:792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1096-0-0x0000000000000000-mapping.dmp

Download
memory/1096-1-0x00000000006B2000-0x00000000006B4000-memory.dmp

Filesize
8KB

Download
memory/1096-2-0x00000000006B2000-0x00000000006B4000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing