Analysis
- max time kernel
174s - max time network
191s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
14/07/2022, 04:29
Static task
static1
Behavioral task
behavioral1
Sample
5e1fb9c0a6ccf8cee26df28ab81f96e8.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5e1fb9c0a6ccf8cee26df28ab81f96e8.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target 5e1fb9c0a6ccf8cee26df28ab81f96e8.exe
- Size 191KB
- Sample220714-e399ladeel
- SHA256 b15d795c0b65e15623fc8f6eb4487e60cf2251572f9bca8f0ec078885df51b14
- MD5 5e1fb9c0a6ccf8cee26df28ab81f96e8
- SHA1 d9668b9e10b8fc8fee49f23d298012bf06e0b4f0
- SHA512 440a6d2c19739e5f96d5e272026ebec3d5d9a3c211f3ed6bf14bea8f5e6031f9e4d239405af82c1a4719c29fdf24cf1fe1c7a57bdd5a972b8f839a57f9a630b0
- MD5 SHA1 SHA512
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3444 set thread context of 4168 3444 5e1fb9c0a6ccf8cee26df28ab81f96e8.exe 80 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5e1fb9c0a6ccf8cee26df28ab81f96e8.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5e1fb9c0a6ccf8cee26df28ab81f96e8.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5e1fb9c0a6ccf8cee26df28ab81f96e8.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4168 5e1fb9c0a6ccf8cee26df28ab81f96e8.exe 4168 5e1fb9c0a6ccf8cee26df28ab81f96e8.exe 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found 384 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 384 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4168 5e1fb9c0a6ccf8cee26df28ab81f96e8.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3444 wrote to memory of 4168 3444 5e1fb9c0a6ccf8cee26df28ab81f96e8.exe 80 PID 3444 wrote to memory of 4168 3444 5e1fb9c0a6ccf8cee26df28ab81f96e8.exe 80 PID 3444 wrote to memory of 4168 3444 5e1fb9c0a6ccf8cee26df28ab81f96e8.exe 80 PID 3444 wrote to memory of 4168 3444 5e1fb9c0a6ccf8cee26df28ab81f96e8.exe 80 PID 3444 wrote to memory of 4168 3444 5e1fb9c0a6ccf8cee26df28ab81f96e8.exe 80 PID 3444 wrote to memory of 4168 3444 5e1fb9c0a6ccf8cee26df28ab81f96e8.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e1fb9c0a6ccf8cee26df28ab81f96e8.exe"C:\Users\Admin\AppData\Local\Temp\5e1fb9c0a6ccf8cee26df28ab81f96e8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\5e1fb9c0a6ccf8cee26df28ab81f96e8.exe"C:\Users\Admin\AppData\Local\Temp\5e1fb9c0a6ccf8cee26df28ab81f96e8.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4168
-