Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 09:05
Static task
static1
Behavioral task
behavioral1
Sample
e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exe
Resource
win10v2004-20220812-en
General
-
Target
e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exe
-
Size
1.3MB
-
MD5
fb1d8137a040fd53abca9451d8ddb751
-
SHA1
df152f523bdc9e7d76265ab23b54078532bf9991
-
SHA256
e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d
-
SHA512
ccd2eb1febefe4c60bdbe9c1e788532a4eb63e535dcc92c15d5de6c13a5278db9399e49dfc3a0f0b35aed73ca0cbc9007e125cee40f61330e43209ae63976c8b
-
SSDEEP
24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak1:7rKo4ZwCOnYjVmJPaW
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exedescription pid process target process PID 2816 set thread context of 3604 2816 e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exe e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exepid process 3604 e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exe 3604 e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exe 3604 e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exe 3604 e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exe 3604 e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exedescription pid process target process PID 2816 wrote to memory of 3604 2816 e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exe e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exe PID 2816 wrote to memory of 3604 2816 e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exe e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exe PID 2816 wrote to memory of 3604 2816 e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exe e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exe PID 2816 wrote to memory of 3604 2816 e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exe e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exe PID 2816 wrote to memory of 3604 2816 e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exe e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exe PID 2816 wrote to memory of 3604 2816 e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exe e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exe PID 2816 wrote to memory of 3604 2816 e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exe e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exe PID 2816 wrote to memory of 3604 2816 e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exe e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exe PID 2816 wrote to memory of 3604 2816 e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exe e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exe PID 2816 wrote to memory of 3604 2816 e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exe e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exe"C:\Users\Admin\AppData\Local\Temp\e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\e67a8b6f6e29a4a6bc57e9112ed3d48ad78b6df99ad19dc4e6b9d9fe5841c82d.exe
- Suspicious use of SetWindowsHookEx
PID:3604