db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb

Analysis

max time kernel
147s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe
Size

1.6MB
MD5

745e960a7c62ec1ba5da7b875231c8d0
SHA1

ef7b38e7107d28f5563542c554b34e4387be1601
SHA256

db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb
SHA512

de8fdab022459bf6e2f82042f9b18d10c58ec1b0ada794eb52675dc765dd3260df79a96769cd14bbe0fab2cb3ac847c997511d06ae19acb0097f568052822398
SSDEEP

24576:tzD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUYV:H6/ye0PIphrp9Zuvjqa0Uidm

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe

description	pid	process	target process
PID 1304 set thread context of 1796	1304	db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe	db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe

pid	process
1796	db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe
1796	db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe
1796	db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe
1796	db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe
1796	db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe

description	pid	process	target process
PID 1304 wrote to memory of 1796	1304	db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe	db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe
PID 1304 wrote to memory of 1796	1304	db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe	db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe
PID 1304 wrote to memory of 1796	1304	db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe	db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe
PID 1304 wrote to memory of 1796	1304	db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe	db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe
PID 1304 wrote to memory of 1796	1304	db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe	db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe
PID 1304 wrote to memory of 1796	1304	db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe	db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe
PID 1304 wrote to memory of 1796	1304	db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe	db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe
PID 1304 wrote to memory of 1796	1304	db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe	db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe
PID 1304 wrote to memory of 1796	1304	db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe	db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe
PID 1304 wrote to memory of 1796	1304	db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe	db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe

C:\Users\Admin\AppData\Local\Temp\db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe
"C:\Users\Admin\AppData\Local\Temp\db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1304

C:\Users\Admin\AppData\Local\Temp\db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe
"C:\Users\Admin\AppData\Local\Temp\db07d83db39f820b44e63370376fc723527c4eefb9bc7c3ca0687154eec000eb.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1796-132-0x0000000000000000-mapping.dmp

Download
memory/1796-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1796-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1796-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1796-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1796-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1796-138-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download