883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 01:43 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe
Size

295KB
MD5

3677daf7ec49eb0a38aee32e13a52772
SHA1

a269122cfd442d92d2cff850563d00478d74eb9e
SHA256

883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142
SHA512

c7a5bd6ee5b50e16dbd6ebd1dc813c5c240f10448f7118c37b0d58531a1d76b29ff8db3c3dfb629a2cc85b9ef11bd853cd179ff56e40aadb74057ae3797b8ed1
SSDEEP

3072:QP8I6KZSE+FSm5CXDtpk3kFIYjyfOznI9varD9Q:Q/kxdVA+

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2424 set thread context of 3760	2424	883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe	85
PID 3760 set thread context of 3576	3760	883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe	86

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3576	883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe
3576	883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe
3576	883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe
3576	883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2424	883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe
3760	883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 3760	2424	883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe	85
PID 2424 wrote to memory of 3760	2424	883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe	85
PID 2424 wrote to memory of 3760	2424	883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe	85
PID 2424 wrote to memory of 3760	2424	883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe	85
PID 2424 wrote to memory of 3760	2424	883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe	85
PID 2424 wrote to memory of 3760	2424	883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe	85
PID 2424 wrote to memory of 3760	2424	883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe	85
PID 2424 wrote to memory of 3760	2424	883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe	85
PID 3760 wrote to memory of 3576	3760	883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe	86
PID 3760 wrote to memory of 3576	3760	883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe	86
PID 3760 wrote to memory of 3576	3760	883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe	86
PID 3760 wrote to memory of 3576	3760	883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe	86
PID 3760 wrote to memory of 3576	3760	883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe	86
PID 3760 wrote to memory of 3576	3760	883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe	86
PID 3760 wrote to memory of 3576	3760	883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe	86
PID 3576 wrote to memory of 2940	3576	883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe	51
PID 3576 wrote to memory of 2940	3576	883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe	51
PID 3576 wrote to memory of 2940	3576	883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe	51
PID 3576 wrote to memory of 2940	3576	883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe	51

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2940
- C:\Users\Admin\AppData\Local\Temp\883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe
  "C:\Users\Admin\AppData\Local\Temp\883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Users\Admin\AppData\Local\Temp\883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe
    C:\Users\Admin\AppData\Local\Temp\883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe
      "C:\Users\Admin\AppData\Local\Temp\883c16c475f38aceb72a84a1c90a8bf0bdd7b8c2264db48c8883325ac1061142.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3576

Network

No results found

93.184.220.29:80

322 B
7
93.184.220.29:80

260 B
5
20.42.73.24:443

322 B
7
178.79.208.1:80

322 B
7
104.80.225.205:443

322 B
7

No results found

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2940-144-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3576-140-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3576-143-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/3576-145-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3760-135-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3760-142-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download