442977f31528f2db2745d7675e06d966606531e98851b4b981da008f8901ebb8

General

Target

0908000009h090000.exe
Size

577KB
MD5

40f119bd23e3dfe95c416a839da87142
SHA1

164cca839ad92c95b3ccbf75873c8d590ff29c89
SHA256

6fa65eef03e50dbaba9ba7729d7d5f4a24d9302c028ec1640db45d47096ab29d
SHA512

57b30e1242d22c4445b28762fa0e14577169d1e6863a989f0cea6a6affe01800ca9c0e6820ee0818bddd8cc4de58754986927be8d06badd7187069c0eafe33b1

Score

1^/10

Malware Config

Signatures

Suspicious behavior: MapViewOfSection 11 IoCs

Processes:

0908000009h090000.exe0908000009h090000.exe0908000009h090000.exe0908000009h090000.exe0908000009h090000.exe0908000009h090000.exe0908000009h090000.exe0908000009h090000.exe0908000009h090000.exe0908000009h090000.exe

pid	process
1972	0908000009h090000.exe
1352	0908000009h090000.exe
1632	0908000009h090000.exe
1108	0908000009h090000.exe
1756	0908000009h090000.exe
1152	0908000009h090000.exe
560	0908000009h090000.exe
656	0908000009h090000.exe
656	0908000009h090000.exe
1716	0908000009h090000.exe
1636	0908000009h090000.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

0908000009h090000.exe0908000009h090000.exe0908000009h090000.exe0908000009h090000.exe0908000009h090000.exe0908000009h090000.exe0908000009h090000.exe0908000009h090000.exe

description	pid	process	target process
PID 1972 wrote to memory of 1976	1972	0908000009h090000.exe	MSBuild.exe
PID 1972 wrote to memory of 1976	1972	0908000009h090000.exe	MSBuild.exe
PID 1972 wrote to memory of 1976	1972	0908000009h090000.exe	MSBuild.exe
PID 1972 wrote to memory of 1976	1972	0908000009h090000.exe	MSBuild.exe
PID 1972 wrote to memory of 1976	1972	0908000009h090000.exe	MSBuild.exe
PID 1972 wrote to memory of 1352	1972	0908000009h090000.exe	0908000009h090000.exe
PID 1972 wrote to memory of 1352	1972	0908000009h090000.exe	0908000009h090000.exe
PID 1972 wrote to memory of 1352	1972	0908000009h090000.exe	0908000009h090000.exe
PID 1972 wrote to memory of 1352	1972	0908000009h090000.exe	0908000009h090000.exe
PID 1352 wrote to memory of 1760	1352	0908000009h090000.exe	MSBuild.exe
PID 1352 wrote to memory of 1760	1352	0908000009h090000.exe	MSBuild.exe
PID 1352 wrote to memory of 1760	1352	0908000009h090000.exe	MSBuild.exe
PID 1352 wrote to memory of 1760	1352	0908000009h090000.exe	MSBuild.exe
PID 1352 wrote to memory of 1760	1352	0908000009h090000.exe	MSBuild.exe
PID 1352 wrote to memory of 1632	1352	0908000009h090000.exe	0908000009h090000.exe
PID 1352 wrote to memory of 1632	1352	0908000009h090000.exe	0908000009h090000.exe
PID 1352 wrote to memory of 1632	1352	0908000009h090000.exe	0908000009h090000.exe
PID 1352 wrote to memory of 1632	1352	0908000009h090000.exe	0908000009h090000.exe
PID 1632 wrote to memory of 1796	1632	0908000009h090000.exe	MSBuild.exe
PID 1632 wrote to memory of 1796	1632	0908000009h090000.exe	MSBuild.exe
PID 1632 wrote to memory of 1796	1632	0908000009h090000.exe	MSBuild.exe
PID 1632 wrote to memory of 1796	1632	0908000009h090000.exe	MSBuild.exe
PID 1632 wrote to memory of 1796	1632	0908000009h090000.exe	MSBuild.exe
PID 1632 wrote to memory of 1108	1632	0908000009h090000.exe	0908000009h090000.exe
PID 1632 wrote to memory of 1108	1632	0908000009h090000.exe	0908000009h090000.exe
PID 1632 wrote to memory of 1108	1632	0908000009h090000.exe	0908000009h090000.exe
PID 1632 wrote to memory of 1108	1632	0908000009h090000.exe	0908000009h090000.exe
PID 1108 wrote to memory of 1464	1108	0908000009h090000.exe	MSBuild.exe
PID 1108 wrote to memory of 1464	1108	0908000009h090000.exe	MSBuild.exe
PID 1108 wrote to memory of 1464	1108	0908000009h090000.exe	MSBuild.exe
PID 1108 wrote to memory of 1464	1108	0908000009h090000.exe	MSBuild.exe
PID 1108 wrote to memory of 1464	1108	0908000009h090000.exe	MSBuild.exe
PID 1108 wrote to memory of 1756	1108	0908000009h090000.exe	0908000009h090000.exe
PID 1108 wrote to memory of 1756	1108	0908000009h090000.exe	0908000009h090000.exe
PID 1108 wrote to memory of 1756	1108	0908000009h090000.exe	0908000009h090000.exe
PID 1108 wrote to memory of 1756	1108	0908000009h090000.exe	0908000009h090000.exe
PID 1756 wrote to memory of 1284	1756	0908000009h090000.exe	MSBuild.exe
PID 1756 wrote to memory of 1284	1756	0908000009h090000.exe	MSBuild.exe
PID 1756 wrote to memory of 1284	1756	0908000009h090000.exe	MSBuild.exe
PID 1756 wrote to memory of 1284	1756	0908000009h090000.exe	MSBuild.exe
PID 1756 wrote to memory of 1284	1756	0908000009h090000.exe	MSBuild.exe
PID 1756 wrote to memory of 1152	1756	0908000009h090000.exe	0908000009h090000.exe
PID 1756 wrote to memory of 1152	1756	0908000009h090000.exe	0908000009h090000.exe
PID 1756 wrote to memory of 1152	1756	0908000009h090000.exe	0908000009h090000.exe
PID 1756 wrote to memory of 1152	1756	0908000009h090000.exe	0908000009h090000.exe
PID 1152 wrote to memory of 1692	1152	0908000009h090000.exe	MSBuild.exe
PID 1152 wrote to memory of 1692	1152	0908000009h090000.exe	MSBuild.exe
PID 1152 wrote to memory of 1692	1152	0908000009h090000.exe	MSBuild.exe
PID 1152 wrote to memory of 1692	1152	0908000009h090000.exe	MSBuild.exe
PID 1152 wrote to memory of 1692	1152	0908000009h090000.exe	MSBuild.exe
PID 1152 wrote to memory of 560	1152	0908000009h090000.exe	0908000009h090000.exe
PID 1152 wrote to memory of 560	1152	0908000009h090000.exe	0908000009h090000.exe
PID 1152 wrote to memory of 560	1152	0908000009h090000.exe	0908000009h090000.exe
PID 1152 wrote to memory of 560	1152	0908000009h090000.exe	0908000009h090000.exe
PID 560 wrote to memory of 520	560	0908000009h090000.exe	MSBuild.exe
PID 560 wrote to memory of 520	560	0908000009h090000.exe	MSBuild.exe
PID 560 wrote to memory of 520	560	0908000009h090000.exe	MSBuild.exe
PID 560 wrote to memory of 520	560	0908000009h090000.exe	MSBuild.exe
PID 560 wrote to memory of 520	560	0908000009h090000.exe	MSBuild.exe
PID 560 wrote to memory of 656	560	0908000009h090000.exe	0908000009h090000.exe
PID 560 wrote to memory of 656	560	0908000009h090000.exe	0908000009h090000.exe
PID 560 wrote to memory of 656	560	0908000009h090000.exe	0908000009h090000.exe
PID 560 wrote to memory of 656	560	0908000009h090000.exe	0908000009h090000.exe
PID 656 wrote to memory of 1060	656	0908000009h090000.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\0908000009h090000.exe
"C:\Users\Admin\AppData\Local\Temp\0908000009h090000.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
PID:1976

C:\Users\Admin\AppData\Local\Temp\0908000009h090000.exe
"C:\Users\Admin\AppData\Local\Temp\0908000009h090000.exe"
2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1352

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
3⤵
PID:1760

C:\Users\Admin\AppData\Local\Temp\0908000009h090000.exe
"C:\Users\Admin\AppData\Local\Temp\0908000009h090000.exe"
3⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
4⤵
PID:1796

C:\Users\Admin\AppData\Local\Temp\0908000009h090000.exe
"C:\Users\Admin\AppData\Local\Temp\0908000009h090000.exe"
4⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
5⤵
PID:1464

C:\Users\Admin\AppData\Local\Temp\0908000009h090000.exe
"C:\Users\Admin\AppData\Local\Temp\0908000009h090000.exe"
5⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
6⤵
PID:1284

C:\Users\Admin\AppData\Local\Temp\0908000009h090000.exe
"C:\Users\Admin\AppData\Local\Temp\0908000009h090000.exe"
6⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1152

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
7⤵
PID:1692

C:\Users\Admin\AppData\Local\Temp\0908000009h090000.exe
"C:\Users\Admin\AppData\Local\Temp\0908000009h090000.exe"
7⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:560

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
8⤵
PID:520

C:\Users\Admin\AppData\Local\Temp\0908000009h090000.exe
"C:\Users\Admin\AppData\Local\Temp\0908000009h090000.exe"
8⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:656

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
9⤵
PID:1060

C:\Users\Admin\AppData\Local\Temp\0908000009h090000.exe
"C:\Users\Admin\AppData\Local\Temp\0908000009h090000.exe"
9⤵
- Suspicious behavior: MapViewOfSection
PID:1716

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
10⤵
PID:1424

C:\Users\Admin\AppData\Local\Temp\0908000009h090000.exe
"C:\Users\Admin\AppData\Local\Temp\0908000009h090000.exe"
10⤵
- Suspicious behavior: MapViewOfSection
PID:1636

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
11⤵
PID:812

C:\Users\Admin\AppData\Local\Temp\0908000009h090000.exe
"C:\Users\Admin\AppData\Local\Temp\0908000009h090000.exe"
11⤵
PID:308

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/308-85-0x00000000001A0000-0x00000000001C9000-memory.dmp

Filesize
164KB

Download
memory/308-83-0x0000000000000000-mapping.dmp

Download
memory/560-71-0x0000000000000000-mapping.dmp

Download
memory/560-73-0x00000000001A0000-0x00000000001C9000-memory.dmp

Filesize
164KB

Download
memory/656-76-0x00000000001A0000-0x00000000001C9000-memory.dmp

Filesize
164KB

Download
memory/656-74-0x0000000000000000-mapping.dmp

Download
memory/1108-62-0x0000000000000000-mapping.dmp

Download
memory/1108-64-0x00000000001A0000-0x00000000001C9000-memory.dmp

Filesize
164KB

Download
memory/1152-68-0x0000000000000000-mapping.dmp

Download
memory/1152-70-0x00000000001A0000-0x00000000001C9000-memory.dmp

Filesize
164KB

Download
memory/1352-56-0x0000000000000000-mapping.dmp

Download
memory/1352-58-0x00000000001A0000-0x00000000001C9000-memory.dmp

Filesize
164KB

Download
memory/1632-59-0x0000000000000000-mapping.dmp

Download
memory/1632-61-0x00000000001A0000-0x00000000001C9000-memory.dmp

Filesize
164KB

Download
memory/1636-80-0x0000000000000000-mapping.dmp

Download
memory/1636-82-0x00000000001A0000-0x00000000001C9000-memory.dmp

Filesize
164KB

Download
memory/1716-77-0x0000000000000000-mapping.dmp

Download
memory/1716-79-0x00000000001A0000-0x00000000001C9000-memory.dmp

Filesize
164KB

Download
memory/1756-65-0x0000000000000000-mapping.dmp

Download
memory/1756-67-0x00000000001A0000-0x00000000001C9000-memory.dmp

Filesize
164KB

Download
memory/1972-54-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download
memory/1972-55-0x00000000001A0000-0x00000000001C9000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing