b42d8a6cb90a8248e582c04d5f35cf7e5bb7cd5db017306609669412f469d1be

Analysis

max time kernel
90s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-10-2022 23:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b42d8a6cb90a8248e582c04d5f35cf7e5bb7cd5db017306609669412f469d1be.exe
Size

223KB
MD5

6873c4653842e311f001cbe6992c4d4d
SHA1

b218b19f9717a5c3ccc053de85ed61aaf33ef72a
SHA256

b42d8a6cb90a8248e582c04d5f35cf7e5bb7cd5db017306609669412f469d1be
SHA512

d61c65529641d30af8fc9ee543d016ca47412a91573dd17fe7cba78ed2e4db8681bad1cae93f93f8761d804d92cb72f2ef63ee6baa3d605fedf5ef1bdce00421
SSDEEP

3072:xAEtMHUsuRscxScK4ujZTvRTQqLtLfEJ4eMEOkUoE+YXgZinCFGIhZtPe0:xjSHwycJaR8qJEJ4SO3oE+YXgZCCd/W

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

Processes:

b42d8a6cb90a8248e582c04d5f35cf7e5bb7cd5db017306609669412f469d1be.exe

description	pid	process	target process
PID 4968 set thread context of 4244	4968	b42d8a6cb90a8248e582c04d5f35cf7e5bb7cd5db017306609669412f469d1be.exe	b42d8a6cb90a8248e582c04d5f35cf7e5bb7cd5db017306609669412f469d1be.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

b42d8a6cb90a8248e582c04d5f35cf7e5bb7cd5db017306609669412f469d1be.exe

description	pid	process	target process
PID 4968 wrote to memory of 4244	4968	b42d8a6cb90a8248e582c04d5f35cf7e5bb7cd5db017306609669412f469d1be.exe	b42d8a6cb90a8248e582c04d5f35cf7e5bb7cd5db017306609669412f469d1be.exe
PID 4968 wrote to memory of 4244	4968	b42d8a6cb90a8248e582c04d5f35cf7e5bb7cd5db017306609669412f469d1be.exe	b42d8a6cb90a8248e582c04d5f35cf7e5bb7cd5db017306609669412f469d1be.exe
PID 4968 wrote to memory of 4244	4968	b42d8a6cb90a8248e582c04d5f35cf7e5bb7cd5db017306609669412f469d1be.exe	b42d8a6cb90a8248e582c04d5f35cf7e5bb7cd5db017306609669412f469d1be.exe
PID 4968 wrote to memory of 4244	4968	b42d8a6cb90a8248e582c04d5f35cf7e5bb7cd5db017306609669412f469d1be.exe	b42d8a6cb90a8248e582c04d5f35cf7e5bb7cd5db017306609669412f469d1be.exe
PID 4968 wrote to memory of 4244	4968	b42d8a6cb90a8248e582c04d5f35cf7e5bb7cd5db017306609669412f469d1be.exe	b42d8a6cb90a8248e582c04d5f35cf7e5bb7cd5db017306609669412f469d1be.exe
PID 4968 wrote to memory of 4244	4968	b42d8a6cb90a8248e582c04d5f35cf7e5bb7cd5db017306609669412f469d1be.exe	b42d8a6cb90a8248e582c04d5f35cf7e5bb7cd5db017306609669412f469d1be.exe
PID 4968 wrote to memory of 4244	4968	b42d8a6cb90a8248e582c04d5f35cf7e5bb7cd5db017306609669412f469d1be.exe	b42d8a6cb90a8248e582c04d5f35cf7e5bb7cd5db017306609669412f469d1be.exe
PID 4968 wrote to memory of 4244	4968	b42d8a6cb90a8248e582c04d5f35cf7e5bb7cd5db017306609669412f469d1be.exe	b42d8a6cb90a8248e582c04d5f35cf7e5bb7cd5db017306609669412f469d1be.exe
PID 4968 wrote to memory of 4244	4968	b42d8a6cb90a8248e582c04d5f35cf7e5bb7cd5db017306609669412f469d1be.exe	b42d8a6cb90a8248e582c04d5f35cf7e5bb7cd5db017306609669412f469d1be.exe
PID 4968 wrote to memory of 4244	4968	b42d8a6cb90a8248e582c04d5f35cf7e5bb7cd5db017306609669412f469d1be.exe	b42d8a6cb90a8248e582c04d5f35cf7e5bb7cd5db017306609669412f469d1be.exe
PID 4968 wrote to memory of 4244	4968	b42d8a6cb90a8248e582c04d5f35cf7e5bb7cd5db017306609669412f469d1be.exe	b42d8a6cb90a8248e582c04d5f35cf7e5bb7cd5db017306609669412f469d1be.exe

C:\Users\Admin\AppData\Local\Temp\b42d8a6cb90a8248e582c04d5f35cf7e5bb7cd5db017306609669412f469d1be.exe
"C:\Users\Admin\AppData\Local\Temp\b42d8a6cb90a8248e582c04d5f35cf7e5bb7cd5db017306609669412f469d1be.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4968

C:\Users\Admin\AppData\Local\Temp\b42d8a6cb90a8248e582c04d5f35cf7e5bb7cd5db017306609669412f469d1be.exe
"C:\Users\Admin\AppData\Local\Temp\b42d8a6cb90a8248e582c04d5f35cf7e5bb7cd5db017306609669412f469d1be.exe"
2⤵
PID:4244

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4244-133-0x0000000000000000-mapping.dmp

Download
memory/4244-135-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4244-134-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4244-137-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4244-138-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4968-132-0x0000000074A30000-0x0000000074FE1000-memory.dmp

Filesize
5.7MB

Download
memory/4968-136-0x0000000074A30000-0x0000000074FE1000-memory.dmp

Filesize
5.7MB

Download