Analysis
-
max time kernel
137s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 09:31
Static task
static1
Behavioral task
behavioral1
Sample
d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exe
Resource
win10v2004-20220812-en
General
-
Target
d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exe
-
Size
1.3MB
-
MD5
2c9099f6c785681c0a84384a1feb5e74
-
SHA1
6d1efa16cf4231dae198954a36c62c7cfd5e596a
-
SHA256
d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d
-
SHA512
142375b5b68a2bc502eaa219bcf312f14b8de1fb267550d7224b558aa4789b4db0e7f62481cc27c4118ed14b111dc8bbcaad58912d8236478bc59f3cef6ecd12
-
SSDEEP
24576:eDASdSysJOcj0VQpWbl7s2LP0CXuiAayiWASALUgv2j6R6XEVeRs9HgVfg6a:BSQtk2zQytkgis6yxra
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exedescription pid process target process PID 4984 set thread context of 4948 4984 d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exe d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exepid process 4948 d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exe 4948 d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exe 4948 d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exe 4948 d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exe 4948 d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exedescription pid process target process PID 4984 wrote to memory of 4948 4984 d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exe d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exe PID 4984 wrote to memory of 4948 4984 d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exe d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exe PID 4984 wrote to memory of 4948 4984 d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exe d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exe PID 4984 wrote to memory of 4948 4984 d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exe d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exe PID 4984 wrote to memory of 4948 4984 d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exe d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exe PID 4984 wrote to memory of 4948 4984 d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exe d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exe PID 4984 wrote to memory of 4948 4984 d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exe d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exe PID 4984 wrote to memory of 4948 4984 d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exe d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exe PID 4984 wrote to memory of 4948 4984 d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exe d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exe PID 4984 wrote to memory of 4948 4984 d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exe d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exe"C:\Users\Admin\AppData\Local\Temp\d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d6ce6f9f8a17db88bf1a52a5c9d3ba974577d624860d8840166685c5bbd4e50d.exe
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4948-132-0x0000000000000000-mapping.dmp
-
memory/4948-133-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/4948-134-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/4948-135-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/4948-136-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/4948-137-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB