Analysis
-
max time kernel
320s -
max time network
371s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 10:55
Static task
static1
Behavioral task
behavioral1
Sample
a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exe
Resource
win10v2004-20221111-en
General
-
Target
a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exe
-
Size
1.6MB
-
MD5
211ef3a70c5723653bc6bd32ddad02fb
-
SHA1
70c4e850dde9ae96961309bc0a357bc6ca480559
-
SHA256
a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea
-
SHA512
98a2f235db9fbf79fd6cb49f9b4fbbad91d832eaba2e307af059f83a70146b5b336575e534f852b03fdfd0d67ab37506716b0a24dec585ff4d6b6a71bb9e541c
-
SSDEEP
24576:BzD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUYM:T6/ye0PIphrp9Zuvjqa0UidP
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{D921C5B0-2B77-46A4-91D6-2622403983E3}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{8CC41791-7CF1-496F-BC8C-5510649C65E2}.catalogItem svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exedescription pid process target process PID 2120 set thread context of 4540 2120 a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exe a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exepid process 4540 a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exe 4540 a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exe 4540 a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exe 4540 a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exe 4540 a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exedescription pid process target process PID 2120 wrote to memory of 4540 2120 a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exe a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exe PID 2120 wrote to memory of 4540 2120 a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exe a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exe PID 2120 wrote to memory of 4540 2120 a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exe a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exe PID 2120 wrote to memory of 4540 2120 a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exe a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exe PID 2120 wrote to memory of 4540 2120 a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exe a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exe PID 2120 wrote to memory of 4540 2120 a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exe a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exe PID 2120 wrote to memory of 4540 2120 a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exe a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exe PID 2120 wrote to memory of 4540 2120 a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exe a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exe PID 2120 wrote to memory of 4540 2120 a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exe a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exe PID 2120 wrote to memory of 4540 2120 a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exe a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exe"C:\Users\Admin\AppData\Local\Temp\a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exe"C:\Users\Admin\AppData\Local\Temp\a30f29c3622e5bb4cde7923437e7102953805b7d8011820d47f5932f7a2ed5ea.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4540-132-0x0000000000000000-mapping.dmp
-
memory/4540-133-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/4540-134-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/4540-135-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/4540-136-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/4540-137-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/4540-138-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB