e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24

Analysis

max time kernel
151s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24.exe
Size

1.3MB
MD5

ab27e770fcaf33f2b5db970672868e13
SHA1

1848a30749ad6947d39de02a75cb2db422bf82ee
SHA256

e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24
SHA512

538a0789f82afafd63c7e17c059ec8b916e7aaf72d98c7c138ff4056bcb8190aa9e33927dbad49e4447cbd0f1c8f3db79785de5e9a675902b98a7a7cf27a9fe2
SSDEEP

24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPako:TrKo4ZwCOnYjVmJPaL

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24.exe

description	pid	process	target process
PID 4772 set thread context of 3044	4772	e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24.exe	e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24.exe

pid	process
3044	e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24.exe
3044	e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24.exe
3044	e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24.exe
3044	e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24.exe
3044	e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24.exe

description	pid	process	target process
PID 4772 wrote to memory of 3044	4772	e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24.exe	e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24.exe
PID 4772 wrote to memory of 3044	4772	e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24.exe	e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24.exe
PID 4772 wrote to memory of 3044	4772	e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24.exe	e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24.exe
PID 4772 wrote to memory of 3044	4772	e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24.exe	e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24.exe
PID 4772 wrote to memory of 3044	4772	e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24.exe	e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24.exe
PID 4772 wrote to memory of 3044	4772	e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24.exe	e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24.exe
PID 4772 wrote to memory of 3044	4772	e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24.exe	e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24.exe
PID 4772 wrote to memory of 3044	4772	e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24.exe	e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24.exe
PID 4772 wrote to memory of 3044	4772	e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24.exe	e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24.exe
PID 4772 wrote to memory of 3044	4772	e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24.exe	e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24.exe

C:\Users\Admin\AppData\Local\Temp\e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24.exe
"C:\Users\Admin\AppData\Local\Temp\e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4772

C:\Users\Admin\AppData\Local\Temp\e1b9bc77ae3d47753ab4d1c88b2fc9d979279eb8eeeda4d8e541dcef2b928f24.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:3044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3044-132-0x0000000000000000-mapping.dmp

Download
memory/3044-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3044-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3044-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3044-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3044-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download