Analysis
- max time kernel
132s - max time network
68s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:44
Static task
static1
Behavioral task
behavioral1
Sample
0b3b7b1bf71efff25e6e6f4b1c0ff68c4505d76e82442d335790d3cfd2ded73a.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0b3b7b1bf71efff25e6e6f4b1c0ff68c4505d76e82442d335790d3cfd2ded73a.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 0b3b7b1bf71efff25e6e6f4b1c0ff68c4505d76e82442d335790d3cfd2ded73a.exe
- Size 2.4MB
- Sample201109-91cjsfjd6a
- SHA256 0b3b7b1bf71efff25e6e6f4b1c0ff68c4505d76e82442d335790d3cfd2ded73a
- MD5 c96f8aa00e9f8bab180b84476e4ccfd0
- SHA1 138db4a63cddf70fb11fbaa765aa27f0935baa8e
- SHA512 c460a125e73e9f573923dbad16e1755020b9f7ea3ee057b043f484b449207dc1b704bd88846c539e44fe62f612b89c6b93af20c5ad45d8a27b685602503ccea1
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2732-3-0x0000000000400000-0x0000000000994000-memory.dmp vmprotect behavioral2/memory/2732-5-0x0000000000400000-0x0000000000994000-memory.dmp vmprotect - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2732 ThumbnailExtractionHost.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 640 set thread context of 2732 640 0b3b7b1bf71efff25e6e6f4b1c0ff68c4505d76e82442d335790d3cfd2ded73a.exe 78 - Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe 2732 ThumbnailExtractionHost.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 640 wrote to memory of 2664 640 0b3b7b1bf71efff25e6e6f4b1c0ff68c4505d76e82442d335790d3cfd2ded73a.exe 75 PID 640 wrote to memory of 2664 640 0b3b7b1bf71efff25e6e6f4b1c0ff68c4505d76e82442d335790d3cfd2ded73a.exe 75 PID 640 wrote to memory of 2664 640 0b3b7b1bf71efff25e6e6f4b1c0ff68c4505d76e82442d335790d3cfd2ded73a.exe 75 PID 640 wrote to memory of 2668 640 0b3b7b1bf71efff25e6e6f4b1c0ff68c4505d76e82442d335790d3cfd2ded73a.exe 76 PID 640 wrote to memory of 2668 640 0b3b7b1bf71efff25e6e6f4b1c0ff68c4505d76e82442d335790d3cfd2ded73a.exe 76 PID 640 wrote to memory of 2668 640 0b3b7b1bf71efff25e6e6f4b1c0ff68c4505d76e82442d335790d3cfd2ded73a.exe 76 PID 640 wrote to memory of 2680 640 0b3b7b1bf71efff25e6e6f4b1c0ff68c4505d76e82442d335790d3cfd2ded73a.exe 77 PID 640 wrote to memory of 2680 640 0b3b7b1bf71efff25e6e6f4b1c0ff68c4505d76e82442d335790d3cfd2ded73a.exe 77 PID 640 wrote to memory of 2680 640 0b3b7b1bf71efff25e6e6f4b1c0ff68c4505d76e82442d335790d3cfd2ded73a.exe 77 PID 640 wrote to memory of 2732 640 0b3b7b1bf71efff25e6e6f4b1c0ff68c4505d76e82442d335790d3cfd2ded73a.exe 78 PID 640 wrote to memory of 2732 640 0b3b7b1bf71efff25e6e6f4b1c0ff68c4505d76e82442d335790d3cfd2ded73a.exe 78 PID 640 wrote to memory of 2732 640 0b3b7b1bf71efff25e6e6f4b1c0ff68c4505d76e82442d335790d3cfd2ded73a.exe 78 PID 640 wrote to memory of 2732 640 0b3b7b1bf71efff25e6e6f4b1c0ff68c4505d76e82442d335790d3cfd2ded73a.exe 78 PID 640 wrote to memory of 2732 640 0b3b7b1bf71efff25e6e6f4b1c0ff68c4505d76e82442d335790d3cfd2ded73a.exe 78 PID 640 wrote to memory of 2732 640 0b3b7b1bf71efff25e6e6f4b1c0ff68c4505d76e82442d335790d3cfd2ded73a.exe 78 PID 640 wrote to memory of 2732 640 0b3b7b1bf71efff25e6e6f4b1c0ff68c4505d76e82442d335790d3cfd2ded73a.exe 78 PID 640 wrote to memory of 2732 640 0b3b7b1bf71efff25e6e6f4b1c0ff68c4505d76e82442d335790d3cfd2ded73a.exe 78 PID 640 wrote to memory of 2732 640 0b3b7b1bf71efff25e6e6f4b1c0ff68c4505d76e82442d335790d3cfd2ded73a.exe 78 PID 640 wrote to memory of 2732 640 0b3b7b1bf71efff25e6e6f4b1c0ff68c4505d76e82442d335790d3cfd2ded73a.exe 78 PID 640 wrote to memory of 2732 640 0b3b7b1bf71efff25e6e6f4b1c0ff68c4505d76e82442d335790d3cfd2ded73a.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b3b7b1bf71efff25e6e6f4b1c0ff68c4505d76e82442d335790d3cfd2ded73a.exe"C:\Users\Admin\AppData\Local\Temp\0b3b7b1bf71efff25e6e6f4b1c0ff68c4505d76e82442d335790d3cfd2ded73a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\SysWOW64\Taskmgr.exe"C:\Windows\SysWOW64\Taskmgr.exe"2⤵PID:2664
-
-
C:\Windows\SysWOW64\ThumbnailExtractionHost.exe"C:\Windows\SysWOW64\ThumbnailExtractionHost.exe"2⤵PID:2668
-
-
C:\Windows\SysWOW64\ThumbnailExtractionHost.exe"C:\Windows\SysWOW64\ThumbnailExtractionHost.exe"2⤵PID:2680
-
-
C:\Windows\SysWOW64\ThumbnailExtractionHost.exe"C:\Windows\SysWOW64\ThumbnailExtractionHost.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2732
-