Overview

overview

6

Static

static

5

352aa870af...36.exe

windows7_x64

6

352aa870af...36.exe

windows10-2004_x64

5

Analysis

  • max time kernel
    95s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    19-06-2022 18:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    352aa870af4367dbfbd69e97f933e7eb88fdbc2b9c6f06fc44550eb6cc3cce36.exe

  • Size

    1.6MB

  • MD5

    dc3a81cc4f57944f8769d3af969c3a80

  • SHA1

    b5985ce4c9d0edd85194082cc7fed320dc7fbaad

  • SHA256

    352aa870af4367dbfbd69e97f933e7eb88fdbc2b9c6f06fc44550eb6cc3cce36

  • SHA512

    ac661795dcc06e75d85d6903f2c67ca0c85cbf8ba566829ea3edb4e0e79bddbf10c5ddc9752f1998dc28ad48f2dc51b2c088f0ecde6d54650bffa861f0179b64

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\352aa870af4367dbfbd69e97f933e7eb88fdbc2b9c6f06fc44550eb6cc3cce36.exe
    "C:\Users\Admin\AppData\Local\Temp\352aa870af4367dbfbd69e97f933e7eb88fdbc2b9c6f06fc44550eb6cc3cce36.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3636
    • C:\Windows\SysWOW64\dllhost.exe
      "C:\Windows\SysWOW64\dllhost.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:2096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2096-130-0x0000000000000000-mapping.dmp
    Download
  • memory/2096-131-0x0000000000400000-0x0000000000471000-memory.dmp
    Filesize

    452KB

    Download