bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea

Analysis

max time kernel
158s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea.exe
Size

1.3MB
MD5

70ed024a72b555b46edf989ac2bf9b48
SHA1

05b5029e7c8521a337c1ffcf3fae111bd9730afc
SHA256

bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea
SHA512

2e6473a3edfa15892e8b5de253d741d31fb53cd1142643a67d17f98eec43f5349d35f9a9bc17d7ee1a9b4feb2d63111434ee359a48b7fe04d7c1aadbf4881816
SSDEEP

24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak:TrKo4ZwCOnYjVmJPa

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea.exe

description	pid	process	target process
PID 4280 set thread context of 2092	4280	bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea.exe	bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea.exe

pid	process
2092	bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea.exe
2092	bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea.exe
2092	bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea.exe
2092	bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea.exe
2092	bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea.exe

description	pid	process	target process
PID 4280 wrote to memory of 2092	4280	bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea.exe	bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea.exe
PID 4280 wrote to memory of 2092	4280	bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea.exe	bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea.exe
PID 4280 wrote to memory of 2092	4280	bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea.exe	bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea.exe
PID 4280 wrote to memory of 2092	4280	bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea.exe	bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea.exe
PID 4280 wrote to memory of 2092	4280	bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea.exe	bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea.exe
PID 4280 wrote to memory of 2092	4280	bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea.exe	bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea.exe
PID 4280 wrote to memory of 2092	4280	bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea.exe	bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea.exe
PID 4280 wrote to memory of 2092	4280	bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea.exe	bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea.exe
PID 4280 wrote to memory of 2092	4280	bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea.exe	bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea.exe
PID 4280 wrote to memory of 2092	4280	bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea.exe	bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea.exe

C:\Users\Admin\AppData\Local\Temp\bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea.exe
"C:\Users\Admin\AppData\Local\Temp\bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4280

C:\Users\Admin\AppData\Local\Temp\bebb0ad7ebeb04df39aac0b102ce84502bcfb6cad4dbcb4206610baca9dc8dea.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:2092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2092-132-0x0000000000000000-mapping.dmp

Download
memory/2092-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2092-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2092-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2092-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2092-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download