Analysis
-
max time kernel
287s -
max time network
345s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 09:54
Static task
static1
Behavioral task
behavioral1
Sample
c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exe
Resource
win10v2004-20221111-en
General
-
Target
c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exe
-
Size
1.6MB
-
MD5
117092a83f6949c7c802b77d18965d75
-
SHA1
4e805b3a7ea6d781551fc99bbd0dc24e12e4afef
-
SHA256
c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61
-
SHA512
909ed1ab1bd078e18abb3368b831bc947c67aa7faa1ebdc304839d1fcf9d613a8a670c8eb3afdb9e5dcee9a35d98f50806f0c5485d4b41b2a78e1260baf54163
-
SSDEEP
24576:tzD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUYw:H6/ye0PIphrp9Zuvjqa0Uidb
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exedescription pid process target process PID 5016 set thread context of 4196 5016 c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exe c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exepid process 4196 c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exe 4196 c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exe 4196 c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exe 4196 c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exe 4196 c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exedescription pid process target process PID 5016 wrote to memory of 4196 5016 c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exe c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exe PID 5016 wrote to memory of 4196 5016 c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exe c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exe PID 5016 wrote to memory of 4196 5016 c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exe c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exe PID 5016 wrote to memory of 4196 5016 c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exe c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exe PID 5016 wrote to memory of 4196 5016 c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exe c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exe PID 5016 wrote to memory of 4196 5016 c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exe c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exe PID 5016 wrote to memory of 4196 5016 c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exe c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exe PID 5016 wrote to memory of 4196 5016 c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exe c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exe PID 5016 wrote to memory of 4196 5016 c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exe c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exe PID 5016 wrote to memory of 4196 5016 c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exe c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exe"C:\Users\Admin\AppData\Local\Temp\c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exe"C:\Users\Admin\AppData\Local\Temp\c7ee6dfda3a919d1242dfd65fffb50015071159c2d9830fff6b7620fa5f98d61.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:4196