Analysis
-
max time kernel
142s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 11:09
Static task
static1
Behavioral task
behavioral1
Sample
99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exe
Resource
win10v2004-20220812-en
General
-
Target
99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exe
-
Size
1.1MB
-
MD5
ed4effe36ed3e3708c381625f3ea12c2
-
SHA1
9b6940cb437513ea195a34c915a9f0139a0c95ca
-
SHA256
99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a
-
SHA512
a6d98b1fd5ae830a6f7bc49467f7a4fc56ee715eeb807a5ecccc8803f2877cc0e06fb6981d2b92afe8da7766f1b249e70a140b5cfbb0db4b8e8df3f759cf67e8
-
SSDEEP
24576:ljmOztIjpVbUJ44R/DDK2s5mNZRzOUCrA/N3rh:lqAtI704g/D3Tm03V
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exedescription pid process target process PID 2700 set thread context of 1544 2700 99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exe 99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exepid process 1544 99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exe 1544 99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exe 1544 99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exe 1544 99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exe 1544 99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exedescription pid process target process PID 2700 wrote to memory of 1544 2700 99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exe 99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exe PID 2700 wrote to memory of 1544 2700 99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exe 99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exe PID 2700 wrote to memory of 1544 2700 99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exe 99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exe PID 2700 wrote to memory of 1544 2700 99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exe 99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exe PID 2700 wrote to memory of 1544 2700 99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exe 99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exe PID 2700 wrote to memory of 1544 2700 99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exe 99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exe PID 2700 wrote to memory of 1544 2700 99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exe 99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exe PID 2700 wrote to memory of 1544 2700 99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exe 99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exe PID 2700 wrote to memory of 1544 2700 99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exe 99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exe PID 2700 wrote to memory of 1544 2700 99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exe 99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exe"C:\Users\Admin\AppData\Local\Temp\99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\99cb603834bf48621ba268da5c5b9bd2daaa3a0b33de67aef183437e69ecf79a.exe
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1544-132-0x0000000000000000-mapping.dmp
-
memory/1544-133-0x0000000000400000-0x00000000004ED000-memory.dmpFilesize
948KB
-
memory/1544-134-0x0000000000400000-0x00000000004ED000-memory.dmpFilesize
948KB
-
memory/1544-135-0x0000000000400000-0x00000000004ED000-memory.dmpFilesize
948KB
-
memory/1544-136-0x0000000000400000-0x00000000004ED000-memory.dmpFilesize
948KB
-
memory/1544-137-0x0000000000400000-0x00000000004ED000-memory.dmpFilesize
948KB