d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a

Analysis

max time kernel
206s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a.exe
Size

1.3MB
MD5

96ebee41fbc233c5fda52d2e0c58b9b8
SHA1

6fe4f2089e6ef1ddb1b708c4df66b2318915920a
SHA256

d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a
SHA512

76ad6c7e15b97b99d02bcd32ae46e81afe8a3f14453f11576dc93630f5cea3009cc3bb45d5e36e675baf81b58b822b12da75da8fb7dbbab38f8f2cd0fcc00146
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakBp:7rKo4ZwCOnYjVmJPaw

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a.exe

description	pid	process	target process
PID 3612 set thread context of 1572	3612	d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a.exe	d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a.exe

pid	process
1572	d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a.exe
1572	d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a.exe
1572	d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a.exe
1572	d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a.exe
1572	d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a.exe

description	pid	process	target process
PID 3612 wrote to memory of 1572	3612	d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a.exe	d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a.exe
PID 3612 wrote to memory of 1572	3612	d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a.exe	d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a.exe
PID 3612 wrote to memory of 1572	3612	d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a.exe	d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a.exe
PID 3612 wrote to memory of 1572	3612	d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a.exe	d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a.exe
PID 3612 wrote to memory of 1572	3612	d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a.exe	d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a.exe
PID 3612 wrote to memory of 1572	3612	d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a.exe	d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a.exe
PID 3612 wrote to memory of 1572	3612	d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a.exe	d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a.exe
PID 3612 wrote to memory of 1572	3612	d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a.exe	d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a.exe
PID 3612 wrote to memory of 1572	3612	d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a.exe	d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a.exe
PID 3612 wrote to memory of 1572	3612	d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a.exe	d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a.exe

C:\Users\Admin\AppData\Local\Temp\d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a.exe
"C:\Users\Admin\AppData\Local\Temp\d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3612

C:\Users\Admin\AppData\Local\Temp\d00e091ba8be8de56691bdf2a18353bc9ea4001fcc27624061a44568bc7c868a.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:1572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1572-132-0x0000000000000000-mapping.dmp

Download
memory/1572-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1572-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1572-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1572-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1572-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1572-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download