2b4a85f8b736835433313b055a805e5f35a9d8ac7ebb12948bdb0e8943adae93

Analysis

max time kernel
161s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2022 07:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b4a85f8b736835433313b055a805e5f35a9d8ac7ebb12948bdb0e8943adae93.exe
Size

176KB
MD5

a7a228cc529dca7a9a0c80a5ba7e3b90
SHA1

86d82d4f85b7ebdd932c5ff5d570e4e61e7cffa1
SHA256

2b4a85f8b736835433313b055a805e5f35a9d8ac7ebb12948bdb0e8943adae93
SHA512

0fba91ede61c8425830ff29f99b7d7fa2cc5a4cd31887356f10a0317e4f70cd898e7f0f4c4de19405250690a522df930395a6ed4b877ebe3242f93a4a8077668
SSDEEP

1536:E43AKmzOqhSYqs+8u2LY/04NUdKzvEo5AxDgw/o8F:rwLca+56U04NgKzvEo5AxDl1F

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4136 set thread context of 1176	4136	2b4a85f8b736835433313b055a805e5f35a9d8ac7ebb12948bdb0e8943adae93.exe	80
PID 4136 set thread context of 0	4136	2b4a85f8b736835433313b055a805e5f35a9d8ac7ebb12948bdb0e8943adae93.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1176	2b4a85f8b736835433313b055a805e5f35a9d8ac7ebb12948bdb0e8943adae93.exe
1176	2b4a85f8b736835433313b055a805e5f35a9d8ac7ebb12948bdb0e8943adae93.exe
1176	2b4a85f8b736835433313b055a805e5f35a9d8ac7ebb12948bdb0e8943adae93.exe
1176	2b4a85f8b736835433313b055a805e5f35a9d8ac7ebb12948bdb0e8943adae93.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4136	2b4a85f8b736835433313b055a805e5f35a9d8ac7ebb12948bdb0e8943adae93.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 1176	4136	2b4a85f8b736835433313b055a805e5f35a9d8ac7ebb12948bdb0e8943adae93.exe	80
PID 4136 wrote to memory of 1176	4136	2b4a85f8b736835433313b055a805e5f35a9d8ac7ebb12948bdb0e8943adae93.exe	80
PID 4136 wrote to memory of 1176	4136	2b4a85f8b736835433313b055a805e5f35a9d8ac7ebb12948bdb0e8943adae93.exe	80
PID 4136 wrote to memory of 1176	4136	2b4a85f8b736835433313b055a805e5f35a9d8ac7ebb12948bdb0e8943adae93.exe	80
PID 4136 wrote to memory of 1176	4136	2b4a85f8b736835433313b055a805e5f35a9d8ac7ebb12948bdb0e8943adae93.exe	80
PID 4136 wrote to memory of 1176	4136	2b4a85f8b736835433313b055a805e5f35a9d8ac7ebb12948bdb0e8943adae93.exe	80
PID 4136 wrote to memory of 1176	4136	2b4a85f8b736835433313b055a805e5f35a9d8ac7ebb12948bdb0e8943adae93.exe	80
PID 4136 wrote to memory of 0	4136	2b4a85f8b736835433313b055a805e5f35a9d8ac7ebb12948bdb0e8943adae93.exe
PID 4136 wrote to memory of 0	4136	2b4a85f8b736835433313b055a805e5f35a9d8ac7ebb12948bdb0e8943adae93.exe
PID 4136 wrote to memory of 0	4136	2b4a85f8b736835433313b055a805e5f35a9d8ac7ebb12948bdb0e8943adae93.exe
PID 4136 wrote to memory of 0	4136	2b4a85f8b736835433313b055a805e5f35a9d8ac7ebb12948bdb0e8943adae93.exe
PID 1176 wrote to memory of 3060	1176	2b4a85f8b736835433313b055a805e5f35a9d8ac7ebb12948bdb0e8943adae93.exe	67
PID 1176 wrote to memory of 3060	1176	2b4a85f8b736835433313b055a805e5f35a9d8ac7ebb12948bdb0e8943adae93.exe	67
PID 1176 wrote to memory of 3060	1176	2b4a85f8b736835433313b055a805e5f35a9d8ac7ebb12948bdb0e8943adae93.exe	67
PID 1176 wrote to memory of 3060	1176	2b4a85f8b736835433313b055a805e5f35a9d8ac7ebb12948bdb0e8943adae93.exe	67

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3060
- C:\Users\Admin\AppData\Local\Temp\2b4a85f8b736835433313b055a805e5f35a9d8ac7ebb12948bdb0e8943adae93.exe
  "C:\Users\Admin\AppData\Local\Temp\2b4a85f8b736835433313b055a805e5f35a9d8ac7ebb12948bdb0e8943adae93.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Users\Admin\AppData\Local\Temp\2b4a85f8b736835433313b055a805e5f35a9d8ac7ebb12948bdb0e8943adae93.exe
    "C:\Users\Admin\AppData\Local\Temp\2b4a85f8b736835433313b055a805e5f35a9d8ac7ebb12948bdb0e8943adae93.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1176-134-0x0000000000000000-mapping.dmp

Download
memory/1176-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1176-138-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1176-140-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3060-139-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download