a4fe9be08f2a56d9f290cd8c6d3346e4e1c08708d93e5f5f2942f748aa723e62

Analysis

max time kernel
54s
max time network
113s
platform
windows10_x64
resource
win10v20210410
submitted
11/08/2021, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f57ba4a92ab8bc274689b2b8cae95cc2.exe
Size 947KB
Sample210811-8yb38bgcss
SHA256 a4fe9be08f2a56d9f290cd8c6d3346e4e1c08708d93e5f5f2942f748aa723e62
MD5 f57ba4a92ab8bc274689b2b8cae95cc2
SHA1 f90f12002d5e685592da3d2a6507a0fb96302f53
SHA512 a39ee18f669d2f0c70910c78abc74f9e3efc84c8c2c77176b19c2196d2fecc685abd37e66946a625ac500400538f60d78c854635457d7d093362030047057706
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3036 set thread context of 204	3036	f57ba4a92ab8bc274689b2b8cae95cc2.exe	79
PID 204 set thread context of 2876	204	f57ba4a92ab8bc274689b2b8cae95cc2.exe	81

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3036	f57ba4a92ab8bc274689b2b8cae95cc2.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 204	3036	f57ba4a92ab8bc274689b2b8cae95cc2.exe	79
PID 3036 wrote to memory of 204	3036	f57ba4a92ab8bc274689b2b8cae95cc2.exe	79
PID 3036 wrote to memory of 204	3036	f57ba4a92ab8bc274689b2b8cae95cc2.exe	79
PID 3036 wrote to memory of 204	3036	f57ba4a92ab8bc274689b2b8cae95cc2.exe	79
PID 3036 wrote to memory of 204	3036	f57ba4a92ab8bc274689b2b8cae95cc2.exe	79
PID 3036 wrote to memory of 204	3036	f57ba4a92ab8bc274689b2b8cae95cc2.exe	79
PID 3036 wrote to memory of 204	3036	f57ba4a92ab8bc274689b2b8cae95cc2.exe	79
PID 3036 wrote to memory of 204	3036	f57ba4a92ab8bc274689b2b8cae95cc2.exe	79
PID 204 wrote to memory of 2876	204	f57ba4a92ab8bc274689b2b8cae95cc2.exe	81
PID 204 wrote to memory of 2876	204	f57ba4a92ab8bc274689b2b8cae95cc2.exe	81
PID 204 wrote to memory of 2876	204	f57ba4a92ab8bc274689b2b8cae95cc2.exe	81
PID 204 wrote to memory of 2876	204	f57ba4a92ab8bc274689b2b8cae95cc2.exe	81
PID 204 wrote to memory of 2876	204	f57ba4a92ab8bc274689b2b8cae95cc2.exe	81
PID 204 wrote to memory of 2876	204	f57ba4a92ab8bc274689b2b8cae95cc2.exe	81
PID 204 wrote to memory of 2876	204	f57ba4a92ab8bc274689b2b8cae95cc2.exe	81
PID 204 wrote to memory of 2876	204	f57ba4a92ab8bc274689b2b8cae95cc2.exe	81
PID 204 wrote to memory of 2876	204	f57ba4a92ab8bc274689b2b8cae95cc2.exe	81

C:\Users\Admin\AppData\Local\Temp\f57ba4a92ab8bc274689b2b8cae95cc2.exe
"C:\Users\Admin\AppData\Local\Temp\f57ba4a92ab8bc274689b2b8cae95cc2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Users\Admin\AppData\Local\Temp\f57ba4a92ab8bc274689b2b8cae95cc2.exe
  "C:\Users\Admin\AppData\Local\Temp\f57ba4a92ab8bc274689b2b8cae95cc2.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:204
- - C:\Users\Admin\AppData\Local\Temp\f57ba4a92ab8bc274689b2b8cae95cc2.exe
    C:\Users\Admin\AppData\Local\Temp\f57ba4a92ab8bc274689b2b8cae95cc2.exe
    3⤵
    PID:2876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/204-127-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/204-134-0x00000000056D0000-0x00000000056D1000-memory.dmp

Download

memory/204-133-0x00000000016F0000-0x00000000016F1000-memory.dmp

Download

memory/204-132-0x0000000002F10000-0x0000000002F11000-memory.dmp

Download

memory/2876-137-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2876-135-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3036-120-0x0000000005050000-0x0000000005051000-memory.dmp

Download

memory/3036-125-0x0000000007510000-0x000000000758B000-memory.dmp

Download

memory/3036-126-0x0000000009BF0000-0x0000000009C00000-memory.dmp

Download

memory/3036-124-0x0000000006C10000-0x0000000006C21000-memory.dmp

Download

memory/3036-122-0x0000000004D40000-0x0000000004D41000-memory.dmp

Download

memory/3036-123-0x0000000004C50000-0x0000000004C51000-memory.dmp

Download

memory/3036-121-0x0000000006AF0000-0x0000000006B77000-memory.dmp

Download

memory/3036-114-0x00000000003F0000-0x00000000003F1000-memory.dmp

Download

memory/3036-119-0x0000000004E10000-0x0000000004E11000-memory.dmp

Download

memory/3036-118-0x0000000004E90000-0x0000000004E91000-memory.dmp

Download

memory/3036-117-0x00000000052F0000-0x00000000052F1000-memory.dmp

Download

memory/3036-116-0x0000000004D50000-0x0000000004D51000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads