9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866

Analysis

max time kernel
91s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866.exe
Size

1.3MB
MD5

cc38105c612b70395ebeea048222b19f
SHA1

9287552ba062d6e1267f925138ea77e524bd7f79
SHA256

9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866
SHA512

cb9dca0275a21593b094ac8c23ab7a8ba25d79f822f747b495d972ba022712c877e6d62bae60486a2ca543aaee8a764ebcba5ed06841798a929613dd1f562375
SSDEEP

24576:brKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakA:brKo4ZwCOnYjVmJPa/

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866.exe

description	pid	process	target process
PID 5060 set thread context of 3752	5060	9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866.exe	9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866.exe

pid	process
3752	9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866.exe
3752	9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866.exe
3752	9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866.exe
3752	9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866.exe
3752	9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866.exe

description	pid	process	target process
PID 5060 wrote to memory of 3752	5060	9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866.exe	9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866.exe
PID 5060 wrote to memory of 3752	5060	9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866.exe	9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866.exe
PID 5060 wrote to memory of 3752	5060	9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866.exe	9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866.exe
PID 5060 wrote to memory of 3752	5060	9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866.exe	9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866.exe
PID 5060 wrote to memory of 3752	5060	9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866.exe	9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866.exe
PID 5060 wrote to memory of 3752	5060	9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866.exe	9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866.exe
PID 5060 wrote to memory of 3752	5060	9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866.exe	9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866.exe
PID 5060 wrote to memory of 3752	5060	9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866.exe	9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866.exe
PID 5060 wrote to memory of 3752	5060	9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866.exe	9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866.exe
PID 5060 wrote to memory of 3752	5060	9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866.exe	9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866.exe

C:\Users\Admin\AppData\Local\Temp\9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866.exe
"C:\Users\Admin\AppData\Local\Temp\9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5060

C:\Users\Admin\AppData\Local\Temp\9df217e905e75f50b122891463cac443f05f167cb52c3e48c271521b45820866.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:3752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3752-132-0x0000000000000000-mapping.dmp

Download
memory/3752-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3752-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3752-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3752-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3752-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download