0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75

General

Target

0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe
Size

237KB
MD5

63bb49f37aa25a2c83b1fd2040ca162e
SHA1

e5f7b42635fedb27f5627989a621d8ca486c35fa
SHA256

0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75
SHA512

7811e1fe99bb835490193c5848468f03725821a29cde561356876ffdee3a10d338d59bc410c3e7fcb053eceb1ee1606feeae18a13c6a2d534e27ad8a2dcc3e5d

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe

description	pid	process	target process
PID 1452 set thread context of 4128	1452	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe

Modifies registry class 3 IoCs

Processes:

0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe

pid	process
4128	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe
4128	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe
4128	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe
4128	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe

pid process

1452 0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe

pid	process
1452	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe

description	pid	process	target process
PID 1452 wrote to memory of 4128	1452	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe
PID 1452 wrote to memory of 4128	1452	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe
PID 1452 wrote to memory of 4128	1452	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe
PID 1452 wrote to memory of 4128	1452	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe
PID 1452 wrote to memory of 4128	1452	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe
PID 1452 wrote to memory of 4128	1452	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe
PID 1452 wrote to memory of 4128	1452	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe
PID 4128 wrote to memory of 2156	4128	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe	Explorer.EXE
PID 4128 wrote to memory of 2156	4128	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe	Explorer.EXE
PID 4128 wrote to memory of 2156	4128	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe	Explorer.EXE
PID 4128 wrote to memory of 2156	4128	0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2156

C:\Users\Admin\AppData\Local\Temp\0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe
"C:\Users\Admin\AppData\Local\Temp\0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe"
2⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1452

C:\Users\Admin\AppData\Local\Temp\0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe
C:\Users\Admin\AppData\Local\Temp\0eca2a787e561acf25d5532971c735c04d95c99fd7db612864b7eb35bc916b75.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2156-135-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/4128-132-0x0000000000000000-mapping.dmp

Download
memory/4128-133-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4128-136-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/4128-137-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads