238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 06:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa.exe
Size

1.1MB
MD5

b877947052f101ee81a5bc43e337034c
SHA1

fb4ad37427488910950cdabf7f87e887fc9be0a8
SHA256

238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa
SHA512

eb5d0271d886d9d7ff23c42c6b62d6a2550454cc8bbcfcd0f275bd0c1e66211cfac73261877185ca9e48a539d8566163f5d2f400c9ea4dca266fab00b43dbc2d
SSDEEP

24576:yio2C4Tz86EE1by3swR9HrwNmojHuD/bsytUltKo+5+VYrle5su:U4TzJJm9R9kFTSbNtkwo+5Vrle5H

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa.exe

description	pid	process	target process
PID 2604 set thread context of 2144	2604	238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa.exe	238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa.exe

pid	process
2144	238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa.exe
2144	238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa.exe
2144	238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa.exe
2144	238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa.exe
2144	238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa.exe

description	pid	process	target process
PID 2604 wrote to memory of 2144	2604	238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa.exe	238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa.exe
PID 2604 wrote to memory of 2144	2604	238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa.exe	238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa.exe
PID 2604 wrote to memory of 2144	2604	238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa.exe	238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa.exe
PID 2604 wrote to memory of 2144	2604	238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa.exe	238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa.exe
PID 2604 wrote to memory of 2144	2604	238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa.exe	238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa.exe
PID 2604 wrote to memory of 2144	2604	238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa.exe	238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa.exe
PID 2604 wrote to memory of 2144	2604	238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa.exe	238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa.exe
PID 2604 wrote to memory of 2144	2604	238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa.exe	238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa.exe
PID 2604 wrote to memory of 2144	2604	238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa.exe	238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa.exe
PID 2604 wrote to memory of 2144	2604	238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa.exe	238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa.exe

C:\Users\Admin\AppData\Local\Temp\238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa.exe
"C:\Users\Admin\AppData\Local\Temp\238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2604

C:\Users\Admin\AppData\Local\Temp\238cc3143b24e4a093f11ea254554ed1b1ce8c037f87d4da86f736e210e19aaa.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:2144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2144-132-0x0000000000000000-mapping.dmp

Download
memory/2144-133-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2144-134-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2144-135-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2144-136-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2144-137-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download