e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da

Analysis

max time kernel
148s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da.exe
Size

1.3MB
MD5

004e000eafb6fd2bf119726614d6ec66
SHA1

be6ca499fb06073d64bf8ea516a8620ad6284188
SHA256

e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da
SHA512

ef356a939eda54081979a4b34717d9f1f37c3a682589c96dbb3e9a6d1ec58e158dc17462b23f902721c7e54b16afe2013a9dea14db4d0f31120b9db2f3e60a73
SSDEEP

24576:brKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakC:brKo4ZwCOnYjVmJPaZ

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da.exe

description	pid	process	target process
PID 4008 set thread context of 3116	4008	e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da.exe	e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da.exe

pid	process
3116	e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da.exe
3116	e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da.exe
3116	e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da.exe
3116	e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da.exe
3116	e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da.exe

description	pid	process	target process
PID 4008 wrote to memory of 3116	4008	e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da.exe	e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da.exe
PID 4008 wrote to memory of 3116	4008	e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da.exe	e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da.exe
PID 4008 wrote to memory of 3116	4008	e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da.exe	e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da.exe
PID 4008 wrote to memory of 3116	4008	e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da.exe	e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da.exe
PID 4008 wrote to memory of 3116	4008	e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da.exe	e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da.exe
PID 4008 wrote to memory of 3116	4008	e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da.exe	e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da.exe
PID 4008 wrote to memory of 3116	4008	e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da.exe	e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da.exe
PID 4008 wrote to memory of 3116	4008	e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da.exe	e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da.exe
PID 4008 wrote to memory of 3116	4008	e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da.exe	e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da.exe
PID 4008 wrote to memory of 3116	4008	e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da.exe	e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da.exe

C:\Users\Admin\AppData\Local\Temp\e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da.exe
"C:\Users\Admin\AppData\Local\Temp\e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4008

C:\Users\Admin\AppData\Local\Temp\e406c87b08f36b7f301d25bc6739d62e8abc2aa3f8597dc6fc4e00ac2c66e4da.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:3116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3116-132-0x0000000000000000-mapping.dmp

Download
memory/3116-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3116-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3116-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3116-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3116-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download