18132c018584420e07d6a2b1709b2c4bd3108560804c06ff7840927d3a9180e9

Analysis

max time kernel
141s
max time network
143s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
03-11-2022 13:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18132c018584420e07d6a2b1709b2c4bd3108560804c06ff7840927d3a9180e9.exe
Size

327KB
MD5

dbfb6acfb79a5a61ad9e83ab8baadd50
SHA1

139ebfcfc30d408622beece85195e10b27f6ecbb
SHA256

18132c018584420e07d6a2b1709b2c4bd3108560804c06ff7840927d3a9180e9
SHA512

e85b6b85730357b39b0d601f156478c3355f5cdc4067923ee9428d035485b4b2c2a783d1543c2414847892c3364425c36042c3fa215c27fd878d9af6c6aed237
SSDEEP

6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4820 set thread context of 1524	4820	18132c018584420e07d6a2b1709b2c4bd3108560804c06ff7840927d3a9180e9.exe	69

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3804	schtasks.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 3472	4820	18132c018584420e07d6a2b1709b2c4bd3108560804c06ff7840927d3a9180e9.exe	67
PID 4820 wrote to memory of 3472	4820	18132c018584420e07d6a2b1709b2c4bd3108560804c06ff7840927d3a9180e9.exe	67
PID 4820 wrote to memory of 3472	4820	18132c018584420e07d6a2b1709b2c4bd3108560804c06ff7840927d3a9180e9.exe	67
PID 4820 wrote to memory of 3368	4820	18132c018584420e07d6a2b1709b2c4bd3108560804c06ff7840927d3a9180e9.exe	68
PID 4820 wrote to memory of 3368	4820	18132c018584420e07d6a2b1709b2c4bd3108560804c06ff7840927d3a9180e9.exe	68
PID 4820 wrote to memory of 3368	4820	18132c018584420e07d6a2b1709b2c4bd3108560804c06ff7840927d3a9180e9.exe	68
PID 4820 wrote to memory of 1524	4820	18132c018584420e07d6a2b1709b2c4bd3108560804c06ff7840927d3a9180e9.exe	69
PID 4820 wrote to memory of 1524	4820	18132c018584420e07d6a2b1709b2c4bd3108560804c06ff7840927d3a9180e9.exe	69
PID 4820 wrote to memory of 1524	4820	18132c018584420e07d6a2b1709b2c4bd3108560804c06ff7840927d3a9180e9.exe	69
PID 4820 wrote to memory of 1524	4820	18132c018584420e07d6a2b1709b2c4bd3108560804c06ff7840927d3a9180e9.exe	69
PID 4820 wrote to memory of 1524	4820	18132c018584420e07d6a2b1709b2c4bd3108560804c06ff7840927d3a9180e9.exe	69
PID 4820 wrote to memory of 1524	4820	18132c018584420e07d6a2b1709b2c4bd3108560804c06ff7840927d3a9180e9.exe	69
PID 4820 wrote to memory of 1524	4820	18132c018584420e07d6a2b1709b2c4bd3108560804c06ff7840927d3a9180e9.exe	69
PID 4820 wrote to memory of 1524	4820	18132c018584420e07d6a2b1709b2c4bd3108560804c06ff7840927d3a9180e9.exe	69
PID 4820 wrote to memory of 1524	4820	18132c018584420e07d6a2b1709b2c4bd3108560804c06ff7840927d3a9180e9.exe	69
PID 1524 wrote to memory of 3804	1524	18132c018584420e07d6a2b1709b2c4bd3108560804c06ff7840927d3a9180e9.exe	70
PID 1524 wrote to memory of 3804	1524	18132c018584420e07d6a2b1709b2c4bd3108560804c06ff7840927d3a9180e9.exe	70
PID 1524 wrote to memory of 3804	1524	18132c018584420e07d6a2b1709b2c4bd3108560804c06ff7840927d3a9180e9.exe	70

C:\Users\Admin\AppData\Local\Temp\18132c018584420e07d6a2b1709b2c4bd3108560804c06ff7840927d3a9180e9.exe
"C:\Users\Admin\AppData\Local\Temp\18132c018584420e07d6a2b1709b2c4bd3108560804c06ff7840927d3a9180e9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Users\Admin\AppData\Local\Temp\18132c018584420e07d6a2b1709b2c4bd3108560804c06ff7840927d3a9180e9.exe
  C:\Users\Admin\AppData\Local\Temp\18132c018584420e07d6a2b1709b2c4bd3108560804c06ff7840927d3a9180e9.exe
  2⤵
  PID:3472
- C:\Users\Admin\AppData\Local\Temp\18132c018584420e07d6a2b1709b2c4bd3108560804c06ff7840927d3a9180e9.exe
  C:\Users\Admin\AppData\Local\Temp\18132c018584420e07d6a2b1709b2c4bd3108560804c06ff7840927d3a9180e9.exe
  2⤵
  PID:3368
- C:\Users\Admin\AppData\Local\Temp\18132c018584420e07d6a2b1709b2c4bd3108560804c06ff7840927d3a9180e9.exe
  C:\Users\Admin\AppData\Local\Temp\18132c018584420e07d6a2b1709b2c4bd3108560804c06ff7840927d3a9180e9.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
    3⤵
    - Creates scheduled task(s)
    PID:3804

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1524-185-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-186-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-176-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-177-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-179-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-228-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1524-180-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-184-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-174-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1524-187-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-183-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-182-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-147-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-155-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-127-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-128-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-130-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-129-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-131-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-132-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-133-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-134-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-135-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-136-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-137-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-138-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-139-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-140-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-141-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-142-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-143-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-144-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-145-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-146-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-125-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-148-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-149-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-150-0x0000000000BD0000-0x0000000000C26000-memory.dmp

Filesize
344KB

Download
memory/4820-151-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-152-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-153-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-126-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-154-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-156-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-157-0x0000000007930000-0x00000000079FC000-memory.dmp

Filesize
816KB

Download
memory/4820-158-0x0000000007F00000-0x00000000083FE000-memory.dmp

Filesize
5.0MB

Download
memory/4820-159-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-160-0x0000000007AA0000-0x0000000007B32000-memory.dmp

Filesize
584KB

Download
memory/4820-161-0x0000000005430000-0x0000000005436000-memory.dmp

Filesize
24KB

Download
memory/4820-162-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-163-0x0000000007D40000-0x0000000007DB6000-memory.dmp

Filesize
472KB

Download
memory/4820-164-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-165-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-166-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-167-0x0000000005480000-0x000000000549E000-memory.dmp

Filesize
120KB

Download
memory/4820-168-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-124-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-169-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-170-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-171-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-172-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-173-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-178-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-123-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-122-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-121-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-120-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-119-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-118-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-117-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download
memory/4820-116-0x0000000077200000-0x000000007738E000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads