da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337

Analysis

max time kernel
112s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 03:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe
Size

206KB
MD5

33e6bb33eec6c2164bf159e828b66965
SHA1

a8d6d15d2675fc511dabdd0380cbc8b248c75688
SHA256

da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337
SHA512

ac5f234e7098bfd280e91a6e796f4267e5e6dcb210f4593b69e63bce9908ba074a8114a068fe32b24f101b2931d1db78dc4a0a9f8ea6c9242e0a8581be25ed7c
SSDEEP

3072:p9xbvI3tMJKDJDu2WE7ZG1SnkOT94qxkuM70bnSs5SU28+NRybbNmK20RDRu3D:p9xUtVDBu2NZG1qFiqZz35SxqpmKvuT

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2292 set thread context of 1376	2292	da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe	83
PID 2292 set thread context of 1376	2292	da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe	83

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2292	da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 1376	2292	da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe	83
PID 2292 wrote to memory of 1376	2292	da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe	83
PID 2292 wrote to memory of 1376	2292	da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe	83

C:\Users\Admin\AppData\Local\Temp\da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe
"C:\Users\Admin\AppData\Local\Temp\da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Users\Admin\AppData\Local\Temp\da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe
  "C:\Users\Admin\AppData\Local\Temp\da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe"
  2⤵
  - Enumerates system info in registry
  PID:1376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1376-136-0x0000000000813000-0x0000000000838000-memory.dmp

Filesize
148KB

Download
memory/1376-137-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1376-139-0x0000000000813000-0x0000000000838000-memory.dmp

Filesize
148KB

Download
memory/2292-132-0x0000000000855000-0x000000000087A000-memory.dmp

Filesize
148KB

Download
memory/2292-134-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2292-135-0x0000000000855000-0x000000000087A000-memory.dmp

Filesize
148KB

Download
memory/2292-138-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2292-140-0x0000000000855000-0x000000000087A000-memory.dmp

Filesize
148KB

Download