Analysis
-
max time kernel
321s -
max time network
330s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 10:58
Static task
static1
Behavioral task
behavioral1
Sample
a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exe
Resource
win10v2004-20221111-en
General
-
Target
a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exe
-
Size
1.3MB
-
MD5
4bd411c405dcab0bb9ee8af2a161e879
-
SHA1
dac76ff37184469aa307110db289bc11d317e13e
-
SHA256
a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba
-
SHA512
ee7387b1880111e1cf3c2bc082c0048fe3e034ef2c1af5853b5ce283977186e2f3659271c947597d288fa29772f1674040fbbafad6707d591942a3b6ab4d306e
-
SSDEEP
24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak9:7rKo4ZwCOnYjVmJPaS
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exedescription pid process target process PID 3176 set thread context of 4576 3176 a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exe a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exepid process 4576 a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exe 4576 a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exe 4576 a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exe 4576 a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exe 4576 a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exedescription pid process target process PID 3176 wrote to memory of 4576 3176 a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exe a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exe PID 3176 wrote to memory of 4576 3176 a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exe a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exe PID 3176 wrote to memory of 4576 3176 a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exe a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exe PID 3176 wrote to memory of 4576 3176 a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exe a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exe PID 3176 wrote to memory of 4576 3176 a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exe a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exe PID 3176 wrote to memory of 4576 3176 a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exe a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exe PID 3176 wrote to memory of 4576 3176 a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exe a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exe PID 3176 wrote to memory of 4576 3176 a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exe a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exe PID 3176 wrote to memory of 4576 3176 a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exe a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exe PID 3176 wrote to memory of 4576 3176 a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exe a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exe"C:\Users\Admin\AppData\Local\Temp\a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a0f8e1746370e94333976134e362f0931f0e58c86c5b3503ad04e35133218cba.exe
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4576-133-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/4576-132-0x0000000000000000-mapping.dmp
-
memory/4576-134-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/4576-135-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/4576-136-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB