bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98

Analysis

max time kernel
144s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98.exe
Size

1.3MB
MD5

5a8a8f5ea3d385fd3c5ae7eebc1510f8
SHA1

12438d60bcafdb6dc23511d2354127a960d6a5b0
SHA256

bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98
SHA512

a0059603036c3eebdb47abc761550e4da76e4a56ea06903e0ad4da0e58728a064786ee5a849d41b13f480e5f2296d50898b26f9ae581261a42dc1d433597edd8
SSDEEP

24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakH:TrKo4ZwCOnYjVmJPas

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98.exe

description	pid	process	target process
PID 2416 set thread context of 4896	2416	bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98.exe	bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98.exe

pid	process
4896	bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98.exe
4896	bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98.exe
4896	bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98.exe
4896	bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98.exe
4896	bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98.exe

description	pid	process	target process
PID 2416 wrote to memory of 4896	2416	bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98.exe	bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98.exe
PID 2416 wrote to memory of 4896	2416	bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98.exe	bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98.exe
PID 2416 wrote to memory of 4896	2416	bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98.exe	bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98.exe
PID 2416 wrote to memory of 4896	2416	bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98.exe	bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98.exe
PID 2416 wrote to memory of 4896	2416	bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98.exe	bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98.exe
PID 2416 wrote to memory of 4896	2416	bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98.exe	bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98.exe
PID 2416 wrote to memory of 4896	2416	bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98.exe	bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98.exe
PID 2416 wrote to memory of 4896	2416	bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98.exe	bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98.exe
PID 2416 wrote to memory of 4896	2416	bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98.exe	bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98.exe
PID 2416 wrote to memory of 4896	2416	bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98.exe	bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98.exe

C:\Users\Admin\AppData\Local\Temp\bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98.exe
"C:\Users\Admin\AppData\Local\Temp\bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2416

C:\Users\Admin\AppData\Local\Temp\bd912ad0f51605f3e8bca4f293f61bf455956c04b28ebb0005a0f13446581d98.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4896-132-0x0000000000000000-mapping.dmp

Download
memory/4896-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4896-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4896-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4896-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4896-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4896-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download