cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8

Analysis

max time kernel
96s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8.exe
Size

1.3MB
MD5

b84e8b00b18fee41dd5da35c603b4aa8
SHA1

05241c036f26d2b2db1d11fcfe0112445051f316
SHA256

cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8
SHA512

9028e406fcf986bea62d2f207dec66fc9a24e25f502a8a6423c4c6c091660132b1b2934ccde70f5ad798e6645cdd90cb8d0b3f48c0958398086c5b4eb6b610c4
SSDEEP

24576:jrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakB:jrKo4ZwCOnYjVmJPaK

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8.exe

description	pid	process	target process
PID 4800 set thread context of 4872	4800	cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8.exe	cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8.exe

pid	process
4872	cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8.exe
4872	cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8.exe
4872	cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8.exe
4872	cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8.exe
4872	cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8.exe

description	pid	process	target process
PID 4800 wrote to memory of 4872	4800	cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8.exe	cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8.exe
PID 4800 wrote to memory of 4872	4800	cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8.exe	cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8.exe
PID 4800 wrote to memory of 4872	4800	cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8.exe	cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8.exe
PID 4800 wrote to memory of 4872	4800	cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8.exe	cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8.exe
PID 4800 wrote to memory of 4872	4800	cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8.exe	cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8.exe
PID 4800 wrote to memory of 4872	4800	cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8.exe	cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8.exe
PID 4800 wrote to memory of 4872	4800	cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8.exe	cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8.exe
PID 4800 wrote to memory of 4872	4800	cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8.exe	cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8.exe
PID 4800 wrote to memory of 4872	4800	cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8.exe	cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8.exe
PID 4800 wrote to memory of 4872	4800	cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8.exe	cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8.exe

C:\Users\Admin\AppData\Local\Temp\cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8.exe
"C:\Users\Admin\AppData\Local\Temp\cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4800

C:\Users\Admin\AppData\Local\Temp\cefbb5ac482eb2ba5dd8a6cdfd6db06b09efe63475abadd06521145bdf7072a8.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4872-132-0x0000000000000000-mapping.dmp

Download
memory/4872-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4872-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4872-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4872-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4872-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4872-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download