da161240a38021eb531b768b37bf975efe6f81366565c5dc8ca7d98879b025b4

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2022, 21:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da161240a38021eb531b768b37bf975efe6f81366565c5dc8ca7d98879b025b4.exe
Size

880KB
MD5

9419c600922588bd47684ec3807162ea
SHA1

91fbbf11eb752dc7448b1bd8c1450e01149f6c51
SHA256

da161240a38021eb531b768b37bf975efe6f81366565c5dc8ca7d98879b025b4
SHA512

86b1993928018039d97134186687fc2197e4b61136af79214b25b6263305ea47fb2faf7c1467972ecbf6b4e360ea0f866fad32d8696b7f4cd35d68c7cd648c86
SSDEEP

24576:Ub2XWFKsyBni+0slOEuDjjSsRfbZHGOpVQB:UOvniDs8EuDjjSsRtpV

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1244	10-14-162945.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4956	da161240a38021eb531b768b37bf975efe6f81366565c5dc8ca7d98879b025b4.exe
4956	da161240a38021eb531b768b37bf975efe6f81366565c5dc8ca7d98879b025b4.exe
4956	da161240a38021eb531b768b37bf975efe6f81366565c5dc8ca7d98879b025b4.exe
4956	da161240a38021eb531b768b37bf975efe6f81366565c5dc8ca7d98879b025b4.exe
4956	da161240a38021eb531b768b37bf975efe6f81366565c5dc8ca7d98879b025b4.exe
4956	da161240a38021eb531b768b37bf975efe6f81366565c5dc8ca7d98879b025b4.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe
1244	10-14-162945.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 1244	4956	da161240a38021eb531b768b37bf975efe6f81366565c5dc8ca7d98879b025b4.exe	82
PID 4956 wrote to memory of 1244	4956	da161240a38021eb531b768b37bf975efe6f81366565c5dc8ca7d98879b025b4.exe	82

C:\Users\Admin\AppData\Local\Temp\da161240a38021eb531b768b37bf975efe6f81366565c5dc8ca7d98879b025b4.exe
"C:\Users\Admin\AppData\Local\Temp\da161240a38021eb531b768b37bf975efe6f81366565c5dc8ca7d98879b025b4.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Users\Admin\AppData\Local\Temp\10-14-162945.exe
  "C:\Users\Admin\AppData\Local\Temp\10-14-162945.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\10-14-162945.exe

Filesize
880KB

MD5
85ca080e2f23c54a690325f81dd5aa2d

SHA1
17eec3400429837c23fd034aacd34d837feb5630

SHA256
3b043c5a8a84eeacd00bb9cfa36700866e5fb647dd6c930ca3d95d11ca18d60f

SHA512
8646e0b06277489ef61ed2c479abb045743d45ea62c62ba7d95ef4b52f1fd9b2342a162086ecc33c170f5aedbee8df4e827e0339919db586c5ff0b4d48c76e6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\10-14-162945.exe

Filesize
880KB

MD5
85ca080e2f23c54a690325f81dd5aa2d

SHA1
17eec3400429837c23fd034aacd34d837feb5630

SHA256
3b043c5a8a84eeacd00bb9cfa36700866e5fb647dd6c930ca3d95d11ca18d60f

SHA512
8646e0b06277489ef61ed2c479abb045743d45ea62c62ba7d95ef4b52f1fd9b2342a162086ecc33c170f5aedbee8df4e827e0339919db586c5ff0b4d48c76e6a

Download Submit
memory/1244-137-0x00007FF7A6600000-0x00007FF7A66E1000-memory.dmp

Filesize
900KB

Download
memory/1244-138-0x00007FF7A6600000-0x00007FF7A66E1000-memory.dmp

Filesize
900KB

Download
memory/4956-132-0x00007FF7DD600000-0x00007FF7DD6E1000-memory.dmp

Filesize
900KB

Download
memory/4956-136-0x00007FF7DD600000-0x00007FF7DD6E1000-memory.dmp

Filesize
900KB

Download