Analysis
-
max time kernel
215s -
max time network
295s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 09:22
Static task
static1
Behavioral task
behavioral1
Sample
dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe
Resource
win10v2004-20220812-en
General
-
Target
dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe
-
Size
1.3MB
-
MD5
c53b72062ae6544495097440dd032a2a
-
SHA1
d434d137a247d21afe91d2db6dab071fac0b3c8a
-
SHA256
dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7
-
SHA512
84427cbcbcead4233db1f839807f1924f42ef1565b2ef96f287f2768d67632618e90cdd4e4e8f41b309a2f2f5459c022da4cbced6167580510b25d4df4b22958
-
SSDEEP
24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak:zrKo4ZwCOnYjVmJPa
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exedescription pid process target process PID 940 set thread context of 1308 940 dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe -
Processes:
dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exepid process 1308 dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe 1308 dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe 1308 dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe 1308 dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe 1308 dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exedescription pid process target process PID 940 wrote to memory of 1308 940 dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe PID 940 wrote to memory of 1308 940 dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe PID 940 wrote to memory of 1308 940 dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe PID 940 wrote to memory of 1308 940 dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe PID 940 wrote to memory of 1308 940 dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe PID 940 wrote to memory of 1308 940 dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe PID 940 wrote to memory of 1308 940 dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe PID 940 wrote to memory of 1308 940 dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe PID 940 wrote to memory of 1308 940 dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe PID 940 wrote to memory of 1308 940 dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe PID 940 wrote to memory of 1308 940 dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe"C:\Users\Admin\AppData\Local\Temp\dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dc69f668de53b0a1a9667bb827b46b8a1d54cc3ed21b12afc891b6577b021cf7.exe
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1308-54-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/1308-55-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/1308-57-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/1308-59-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/1308-61-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/1308-63-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/1308-65-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/1308-66-0x000000000044E057-mapping.dmp
-
memory/1308-68-0x0000000076391000-0x0000000076393000-memory.dmpFilesize
8KB
-
memory/1308-69-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/1308-70-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/1308-71-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/1308-73-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB