bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405

Analysis

max time kernel
193s
max time network
222s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405.exe
Size

1.3MB
MD5

1c68c09c0d39f1d94409993d75016d9e
SHA1

d4743992f44692d10e23eb309cdf0169879f949b
SHA256

bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405
SHA512

08be609065caaf3bc45565e8a80cf21e8bc7272a8d58c5d6a2244bf1b899195d58a0612f5dc51d0ac4fb45b5e4961771417f1329dc7235ff20ade5d8e6f672ef
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakZn:zrKo4ZwCOnYjVmJPawn

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405.exe

description	pid	process	target process
PID 1124 set thread context of 424	1124	bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405.exe	bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405.exe

pid	process
424	bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405.exe
424	bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405.exe
424	bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405.exe
424	bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405.exe
424	bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405.exe

description	pid	process	target process
PID 1124 wrote to memory of 424	1124	bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405.exe	bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405.exe
PID 1124 wrote to memory of 424	1124	bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405.exe	bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405.exe
PID 1124 wrote to memory of 424	1124	bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405.exe	bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405.exe
PID 1124 wrote to memory of 424	1124	bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405.exe	bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405.exe
PID 1124 wrote to memory of 424	1124	bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405.exe	bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405.exe
PID 1124 wrote to memory of 424	1124	bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405.exe	bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405.exe
PID 1124 wrote to memory of 424	1124	bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405.exe	bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405.exe
PID 1124 wrote to memory of 424	1124	bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405.exe	bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405.exe
PID 1124 wrote to memory of 424	1124	bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405.exe	bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405.exe
PID 1124 wrote to memory of 424	1124	bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405.exe	bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405.exe

C:\Users\Admin\AppData\Local\Temp\bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405.exe
"C:\Users\Admin\AppData\Local\Temp\bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1124

C:\Users\Admin\AppData\Local\Temp\bda84fda1183ef216d23aaf6b056fc02de2a1be38dff3a1cc5eb1adca90d5405.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/424-132-0x0000000000000000-mapping.dmp

Download
memory/424-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/424-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/424-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/424-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/424-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/424-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download