Analysis
-
max time kernel
149s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
14-04-2022 12:22
Static task
static1
Behavioral task
behavioral1
Sample
M097508E2-20F2-4C2C-879A.exe
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
M097508E2-20F2-4C2C-879A.exe
Resource
win10v2004-20220331-en
0 signatures
0 seconds
General
-
Target
M097508E2-20F2-4C2C-879A.exe
-
Size
709KB
-
MD5
13f08d08bbaa99bfd4cf481cf682bd7d
-
SHA1
210fce69f4278eb3f9e2574eb1d3fd7febe8212c
-
SHA256
d32af58205d0773daf139d13738f918e03f4d30439086b6eda0dfceef3369b58
-
SHA512
4483ba364a7525b2c8a6e2154a9d166873aba8ea1fa717c06aa90db7c1d540e317425cc33c254fbf41cd26cad2eb196c093b86d5c3e0c9c6fed358795d357330
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: MapViewOfSection 18 IoCs
Processes:
M097508E2-20F2-4C2C-879A.exeM097508E2-20F2-4C2C-879A.exeM097508E2-20F2-4C2C-879A.exeM097508E2-20F2-4C2C-879A.exeM097508E2-20F2-4C2C-879A.exeM097508E2-20F2-4C2C-879A.exeM097508E2-20F2-4C2C-879A.exeM097508E2-20F2-4C2C-879A.exeM097508E2-20F2-4C2C-879A.exeM097508E2-20F2-4C2C-879A.exeM097508E2-20F2-4C2C-879A.exeM097508E2-20F2-4C2C-879A.exeM097508E2-20F2-4C2C-879A.exeM097508E2-20F2-4C2C-879A.exepid process 2028 M097508E2-20F2-4C2C-879A.exe 1392 M097508E2-20F2-4C2C-879A.exe 956 M097508E2-20F2-4C2C-879A.exe 844 M097508E2-20F2-4C2C-879A.exe 1576 M097508E2-20F2-4C2C-879A.exe 1576 M097508E2-20F2-4C2C-879A.exe 944 M097508E2-20F2-4C2C-879A.exe 520 M097508E2-20F2-4C2C-879A.exe 324 M097508E2-20F2-4C2C-879A.exe 324 M097508E2-20F2-4C2C-879A.exe 608 M097508E2-20F2-4C2C-879A.exe 608 M097508E2-20F2-4C2C-879A.exe 1540 M097508E2-20F2-4C2C-879A.exe 876 M097508E2-20F2-4C2C-879A.exe 876 M097508E2-20F2-4C2C-879A.exe 2016 M097508E2-20F2-4C2C-879A.exe 1472 M097508E2-20F2-4C2C-879A.exe 468 M097508E2-20F2-4C2C-879A.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
M097508E2-20F2-4C2C-879A.exeM097508E2-20F2-4C2C-879A.exeM097508E2-20F2-4C2C-879A.exeM097508E2-20F2-4C2C-879A.exeM097508E2-20F2-4C2C-879A.exeM097508E2-20F2-4C2C-879A.exeM097508E2-20F2-4C2C-879A.exeM097508E2-20F2-4C2C-879A.exedescription pid process target process PID 2028 wrote to memory of 1388 2028 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 2028 wrote to memory of 1388 2028 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 2028 wrote to memory of 1388 2028 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 2028 wrote to memory of 1388 2028 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 2028 wrote to memory of 1388 2028 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 2028 wrote to memory of 1392 2028 M097508E2-20F2-4C2C-879A.exe M097508E2-20F2-4C2C-879A.exe PID 2028 wrote to memory of 1392 2028 M097508E2-20F2-4C2C-879A.exe M097508E2-20F2-4C2C-879A.exe PID 2028 wrote to memory of 1392 2028 M097508E2-20F2-4C2C-879A.exe M097508E2-20F2-4C2C-879A.exe PID 2028 wrote to memory of 1392 2028 M097508E2-20F2-4C2C-879A.exe M097508E2-20F2-4C2C-879A.exe PID 1392 wrote to memory of 1808 1392 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 1392 wrote to memory of 1808 1392 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 1392 wrote to memory of 1808 1392 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 1392 wrote to memory of 1808 1392 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 1392 wrote to memory of 1808 1392 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 1392 wrote to memory of 956 1392 M097508E2-20F2-4C2C-879A.exe M097508E2-20F2-4C2C-879A.exe PID 1392 wrote to memory of 956 1392 M097508E2-20F2-4C2C-879A.exe M097508E2-20F2-4C2C-879A.exe PID 1392 wrote to memory of 956 1392 M097508E2-20F2-4C2C-879A.exe M097508E2-20F2-4C2C-879A.exe PID 1392 wrote to memory of 956 1392 M097508E2-20F2-4C2C-879A.exe M097508E2-20F2-4C2C-879A.exe PID 956 wrote to memory of 1332 956 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 956 wrote to memory of 1332 956 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 956 wrote to memory of 1332 956 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 956 wrote to memory of 1332 956 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 956 wrote to memory of 1332 956 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 956 wrote to memory of 844 956 M097508E2-20F2-4C2C-879A.exe M097508E2-20F2-4C2C-879A.exe PID 956 wrote to memory of 844 956 M097508E2-20F2-4C2C-879A.exe M097508E2-20F2-4C2C-879A.exe PID 956 wrote to memory of 844 956 M097508E2-20F2-4C2C-879A.exe M097508E2-20F2-4C2C-879A.exe PID 956 wrote to memory of 844 956 M097508E2-20F2-4C2C-879A.exe M097508E2-20F2-4C2C-879A.exe PID 844 wrote to memory of 2044 844 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 844 wrote to memory of 2044 844 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 844 wrote to memory of 2044 844 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 844 wrote to memory of 2044 844 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 844 wrote to memory of 2044 844 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 844 wrote to memory of 1576 844 M097508E2-20F2-4C2C-879A.exe M097508E2-20F2-4C2C-879A.exe PID 844 wrote to memory of 1576 844 M097508E2-20F2-4C2C-879A.exe M097508E2-20F2-4C2C-879A.exe PID 844 wrote to memory of 1576 844 M097508E2-20F2-4C2C-879A.exe M097508E2-20F2-4C2C-879A.exe PID 844 wrote to memory of 1576 844 M097508E2-20F2-4C2C-879A.exe M097508E2-20F2-4C2C-879A.exe PID 1576 wrote to memory of 1836 1576 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 1576 wrote to memory of 1836 1576 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 1576 wrote to memory of 1836 1576 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 1576 wrote to memory of 1836 1576 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 1576 wrote to memory of 1836 1576 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 1576 wrote to memory of 944 1576 M097508E2-20F2-4C2C-879A.exe M097508E2-20F2-4C2C-879A.exe PID 1576 wrote to memory of 944 1576 M097508E2-20F2-4C2C-879A.exe M097508E2-20F2-4C2C-879A.exe PID 1576 wrote to memory of 944 1576 M097508E2-20F2-4C2C-879A.exe M097508E2-20F2-4C2C-879A.exe PID 1576 wrote to memory of 944 1576 M097508E2-20F2-4C2C-879A.exe M097508E2-20F2-4C2C-879A.exe PID 944 wrote to memory of 528 944 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 944 wrote to memory of 528 944 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 944 wrote to memory of 528 944 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 944 wrote to memory of 528 944 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 944 wrote to memory of 528 944 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 944 wrote to memory of 520 944 M097508E2-20F2-4C2C-879A.exe M097508E2-20F2-4C2C-879A.exe PID 944 wrote to memory of 520 944 M097508E2-20F2-4C2C-879A.exe M097508E2-20F2-4C2C-879A.exe PID 944 wrote to memory of 520 944 M097508E2-20F2-4C2C-879A.exe M097508E2-20F2-4C2C-879A.exe PID 944 wrote to memory of 520 944 M097508E2-20F2-4C2C-879A.exe M097508E2-20F2-4C2C-879A.exe PID 520 wrote to memory of 1772 520 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 520 wrote to memory of 1772 520 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 520 wrote to memory of 1772 520 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 520 wrote to memory of 1772 520 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 520 wrote to memory of 1772 520 M097508E2-20F2-4C2C-879A.exe MSBuild.exe PID 520 wrote to memory of 324 520 M097508E2-20F2-4C2C-879A.exe M097508E2-20F2-4C2C-879A.exe PID 520 wrote to memory of 324 520 M097508E2-20F2-4C2C-879A.exe M097508E2-20F2-4C2C-879A.exe PID 520 wrote to memory of 324 520 M097508E2-20F2-4C2C-879A.exe M097508E2-20F2-4C2C-879A.exe PID 520 wrote to memory of 324 520 M097508E2-20F2-4C2C-879A.exe M097508E2-20F2-4C2C-879A.exe PID 324 wrote to memory of 1160 324 M097508E2-20F2-4C2C-879A.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\M097508E2-20F2-4C2C-879A.exe"C:\Users\Admin\AppData\Local\Temp\M097508E2-20F2-4C2C-879A.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\M097508E2-20F2-4C2C-879A.exe"C:\Users\Admin\AppData\Local\Temp\M097508E2-20F2-4C2C-879A.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\M097508E2-20F2-4C2C-879A.exe"C:\Users\Admin\AppData\Local\Temp\M097508E2-20F2-4C2C-879A.exe"3⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\M097508E2-20F2-4C2C-879A.exe"C:\Users\Admin\AppData\Local\Temp\M097508E2-20F2-4C2C-879A.exe"4⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"5⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\M097508E2-20F2-4C2C-879A.exe"C:\Users\Admin\AppData\Local\Temp\M097508E2-20F2-4C2C-879A.exe"5⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"6⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\M097508E2-20F2-4C2C-879A.exe"C:\Users\Admin\AppData\Local\Temp\M097508E2-20F2-4C2C-879A.exe"6⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"7⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\M097508E2-20F2-4C2C-879A.exe"C:\Users\Admin\AppData\Local\Temp\M097508E2-20F2-4C2C-879A.exe"7⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"8⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\M097508E2-20F2-4C2C-879A.exe"C:\Users\Admin\AppData\Local\Temp\M097508E2-20F2-4C2C-879A.exe"8⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"9⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\M097508E2-20F2-4C2C-879A.exe"C:\Users\Admin\AppData\Local\Temp\M097508E2-20F2-4C2C-879A.exe"9⤵
- Suspicious behavior: MapViewOfSection
PID:608 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"10⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\M097508E2-20F2-4C2C-879A.exe"C:\Users\Admin\AppData\Local\Temp\M097508E2-20F2-4C2C-879A.exe"10⤵
- Suspicious behavior: MapViewOfSection
PID:1540 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"11⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\M097508E2-20F2-4C2C-879A.exe"C:\Users\Admin\AppData\Local\Temp\M097508E2-20F2-4C2C-879A.exe"11⤵
- Suspicious behavior: MapViewOfSection
PID:876 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"12⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\M097508E2-20F2-4C2C-879A.exe"C:\Users\Admin\AppData\Local\Temp\M097508E2-20F2-4C2C-879A.exe"12⤵
- Suspicious behavior: MapViewOfSection
PID:2016 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"13⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\M097508E2-20F2-4C2C-879A.exe"C:\Users\Admin\AppData\Local\Temp\M097508E2-20F2-4C2C-879A.exe"13⤵
- Suspicious behavior: MapViewOfSection
PID:1472 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"14⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\M097508E2-20F2-4C2C-879A.exe"C:\Users\Admin\AppData\Local\Temp\M097508E2-20F2-4C2C-879A.exe"14⤵
- Suspicious behavior: MapViewOfSection
PID:468 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"15⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\M097508E2-20F2-4C2C-879A.exe"C:\Users\Admin\AppData\Local\Temp\M097508E2-20F2-4C2C-879A.exe"15⤵PID:1768