Analysis
-
max time kernel
187s -
max time network
198s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 09:52
Static task
static1
Behavioral task
behavioral1
Sample
c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exe
Resource
win10v2004-20220812-en
General
-
Target
c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exe
-
Size
1.3MB
-
MD5
8e50ad329f5bb7ab924556dc1ad2ac32
-
SHA1
f13fb053dd2b871be7de5af58a06a67966181c01
-
SHA256
c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48
-
SHA512
cf3d7c5b6f7ff4d58c071635d7b61e209a1841db12b825121067ff0b2138653fbbc04ef96ff5f96e73d3a3f1ded1613f9e29a362bd05a2e3b1499d657ea1c700
-
SSDEEP
24576:brKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakC:brKo4ZwCOnYjVmJPaB
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exedescription pid process target process PID 2100 set thread context of 2308 2100 c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exe c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exepid process 2308 c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exe 2308 c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exe 2308 c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exe 2308 c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exe 2308 c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exedescription pid process target process PID 2100 wrote to memory of 2308 2100 c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exe c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exe PID 2100 wrote to memory of 2308 2100 c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exe c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exe PID 2100 wrote to memory of 2308 2100 c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exe c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exe PID 2100 wrote to memory of 2308 2100 c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exe c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exe PID 2100 wrote to memory of 2308 2100 c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exe c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exe PID 2100 wrote to memory of 2308 2100 c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exe c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exe PID 2100 wrote to memory of 2308 2100 c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exe c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exe PID 2100 wrote to memory of 2308 2100 c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exe c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exe PID 2100 wrote to memory of 2308 2100 c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exe c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exe PID 2100 wrote to memory of 2308 2100 c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exe c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exe"C:\Users\Admin\AppData\Local\Temp\c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\c96f26eb23cbc211af55587fa107b8817df45add2841a72a7bd76561f184bd48.exe
- Suspicious use of SetWindowsHookEx
PID:2308