003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640.exe
Size

1.4MB
MD5

bc5a69f6a400fe7af914fa289f501b1c
SHA1

5bfc189e23a83cbcb72749a0c68e67f35b598f43
SHA256

003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640
SHA512

c05757acf92ad50d731e9093a5f63d00fd7c32455803ab87d297c171e8beff5677af0b20a826112874273480a6b1d43693878beb560cd2543200399fd47f892e
SSDEEP

24576:BrK6dClXmekxlm1dl4r260n4dz0as5jc3AZ1COwiUP/5lq8AF:BrBew72604doSw6ewK

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640.exe

description	pid	process	target process
PID 3172 set thread context of 3960	3172	003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640.exe	003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640.exe

pid	process
3960	003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640.exe
3960	003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640.exe
3960	003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640.exe
3960	003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640.exe
3960	003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640.exe

description	pid	process	target process
PID 3172 wrote to memory of 3960	3172	003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640.exe	003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640.exe
PID 3172 wrote to memory of 3960	3172	003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640.exe	003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640.exe
PID 3172 wrote to memory of 3960	3172	003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640.exe	003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640.exe
PID 3172 wrote to memory of 3960	3172	003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640.exe	003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640.exe
PID 3172 wrote to memory of 3960	3172	003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640.exe	003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640.exe
PID 3172 wrote to memory of 3960	3172	003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640.exe	003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640.exe
PID 3172 wrote to memory of 3960	3172	003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640.exe	003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640.exe
PID 3172 wrote to memory of 3960	3172	003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640.exe	003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640.exe
PID 3172 wrote to memory of 3960	3172	003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640.exe	003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640.exe
PID 3172 wrote to memory of 3960	3172	003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640.exe	003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640.exe

C:\Users\Admin\AppData\Local\Temp\003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640.exe
"C:\Users\Admin\AppData\Local\Temp\003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3172

C:\Users\Admin\AppData\Local\Temp\003baacad7a7db41a712dbf75da220d0883e6eefab20e2c3c97cc200d9940640.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:3960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3960-132-0x0000000000000000-mapping.dmp

Download
memory/3960-133-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/3960-134-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/3960-135-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/3960-136-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/3960-137-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download