b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910

Analysis

max time kernel
152s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910.exe
Size

1.3MB
MD5

cb9df5f6288d2ad44f61fc1b7d8de083
SHA1

1abece67fc2b0307e2a57c3cafb281472fb97cf9
SHA256

b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910
SHA512

f33a01cc45627289a3413d61feb3a1d3d971bda6b3e9aa0655e06591af779e03d801b03fa37acc31ae53219853cb51765a0038998afd7e5f3ae036d13d32130c
SSDEEP

24576:AxP8/8Mle/jYpx1BNgldCjjhyYQCuA0VaBVSK3yg13J2uUme4ZDDK:ApILclE5yYQ/daqrKJ2Se4ZS

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910.exe

description	pid	process	target process
PID 4124 set thread context of 1320	4124	b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910.exe	b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910.exe

pid	process
1320	b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910.exe
1320	b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910.exe
1320	b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910.exe
1320	b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910.exe
1320	b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910.exe

description	pid	process	target process
PID 4124 wrote to memory of 1320	4124	b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910.exe	b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910.exe
PID 4124 wrote to memory of 1320	4124	b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910.exe	b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910.exe
PID 4124 wrote to memory of 1320	4124	b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910.exe	b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910.exe
PID 4124 wrote to memory of 1320	4124	b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910.exe	b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910.exe
PID 4124 wrote to memory of 1320	4124	b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910.exe	b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910.exe
PID 4124 wrote to memory of 1320	4124	b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910.exe	b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910.exe
PID 4124 wrote to memory of 1320	4124	b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910.exe	b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910.exe
PID 4124 wrote to memory of 1320	4124	b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910.exe	b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910.exe
PID 4124 wrote to memory of 1320	4124	b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910.exe	b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910.exe
PID 4124 wrote to memory of 1320	4124	b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910.exe	b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910.exe

C:\Users\Admin\AppData\Local\Temp\b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910.exe
"C:\Users\Admin\AppData\Local\Temp\b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4124

C:\Users\Admin\AppData\Local\Temp\b9e3aec336af4c946307a6920b3fe66826836c5e9fa06bbce59807d676697910.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:1320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1320-132-0x0000000000000000-mapping.dmp

Download
memory/1320-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1320-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1320-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1320-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1320-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download