Analysis
- max time kernel
85s - max time network
164s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
02/09/2022, 10:17
General
- Target 19155af0ca359b2e31ee4d84e2792e5f0e26bc3f144255123cdb7231a5326cda.exe
- Size 2.3MB
- Sample220902-mbcs1sccbn
- SHA256 19155af0ca359b2e31ee4d84e2792e5f0e26bc3f144255123cdb7231a5326cda
Malware Config
Signatures
- Downloads MZ/PE file
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\19155af0ca359b2e31ee4d84e2792e5f0e26bc3f144255123cdb7231a5326cda.exe"C:\Users\Admin\AppData\Local\Temp\19155af0ca359b2e31ee4d84e2792e5f0e26bc3f144255123cdb7231a5326cda.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1940-63-0x0000000000400000-0x0000000000544000-memory.dmp
memory/1940-78-0x0000000000400000-0x0000000000544000-memory.dmp
memory/148600-69-0x0000000006A10000-0x0000000006CC7000-memory.dmp
memory/148600-71-0x0000000006A10000-0x0000000006CC7000-memory.dmp
memory/148600-64-0x0000000000400000-0x0000000000405000-memory.dmp
memory/148600-65-0x0000000075B41000-0x0000000075B43000-memory.dmp
memory/148600-66-0x0000000000400000-0x0000000000405000-memory.dmp
memory/148600-67-0x0000000006A10000-0x0000000006CC7000-memory.dmp
memory/148600-56-0x0000000000400000-0x0000000000405000-memory.dmp
memory/148600-73-0x0000000006A10000-0x0000000006CC7000-memory.dmp
memory/148600-76-0x0000000006A10000-0x0000000006CC7000-memory.dmp
memory/148600-75-0x0000000006A10000-0x0000000006CC7000-memory.dmp
memory/148600-54-0x0000000000400000-0x0000000000405000-memory.dmp
memory/148600-79-0x0000000006A10000-0x0000000006CC7000-memory.dmp
memory/148600-80-0x0000000006A10000-0x0000000006CC7000-memory.dmp