e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675

Analysis

max time kernel
205s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675.exe
Size

1.3MB
MD5

4b6fba139aaddb10c81c206d03c73f74
SHA1

d085691b08471939cc43ee43d414b27731d31543
SHA256

e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675
SHA512

2fe5c5a3afa5389bbbd7a99f9f66a3c36b70d8c9ea136109334d906c33542b723549fba0e8c618d952f3345c9ba2267e2e3a3bb0634d1a9c958976734014cf4a
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak:zrKo4ZwCOnYjVmJPa

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675.exe

description	pid	process	target process
PID 4280 set thread context of 3764	4280	e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675.exe	e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675.exe

pid	process
3764	e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675.exe
3764	e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675.exe
3764	e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675.exe
3764	e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675.exe
3764	e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675.exe

description	pid	process	target process
PID 4280 wrote to memory of 3764	4280	e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675.exe	e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675.exe
PID 4280 wrote to memory of 3764	4280	e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675.exe	e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675.exe
PID 4280 wrote to memory of 3764	4280	e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675.exe	e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675.exe
PID 4280 wrote to memory of 3764	4280	e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675.exe	e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675.exe
PID 4280 wrote to memory of 3764	4280	e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675.exe	e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675.exe
PID 4280 wrote to memory of 3764	4280	e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675.exe	e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675.exe
PID 4280 wrote to memory of 3764	4280	e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675.exe	e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675.exe
PID 4280 wrote to memory of 3764	4280	e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675.exe	e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675.exe
PID 4280 wrote to memory of 3764	4280	e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675.exe	e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675.exe
PID 4280 wrote to memory of 3764	4280	e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675.exe	e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675.exe

C:\Users\Admin\AppData\Local\Temp\e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675.exe
"C:\Users\Admin\AppData\Local\Temp\e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4280

C:\Users\Admin\AppData\Local\Temp\e3c2c06259e77c7c3c14b97053bb617feac9847086868feee1cbf458bd28b675.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:3764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3764-132-0x0000000000000000-mapping.dmp

Download
memory/3764-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3764-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3764-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3764-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3764-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3764-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download