b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74

Analysis

max time kernel
177s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74.exe
Size

1.3MB
MD5

98c2ba73d4c83ad3ddc313729ba16931
SHA1

fbec1103b109a2d84c6f2ddb915463e01a77b81e
SHA256

b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74
SHA512

48d278d42b2a29e8f8cf231c93c32a1bfe766c9e897a9ac4d01da3d3fa2d04d07498a4093f8f1091105a1b818e95235b69ed8f8092e7d31da58e14625bc9668d
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak:7rKo4ZwCOnYjVmJPa

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74.exe

description	pid	process	target process
PID 3068 set thread context of 4612	3068	b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74.exe	b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74.exe

pid	process
4612	b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74.exe
4612	b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74.exe
4612	b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74.exe
4612	b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74.exe
4612	b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74.exe

description	pid	process	target process
PID 3068 wrote to memory of 4612	3068	b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74.exe	b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74.exe
PID 3068 wrote to memory of 4612	3068	b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74.exe	b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74.exe
PID 3068 wrote to memory of 4612	3068	b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74.exe	b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74.exe
PID 3068 wrote to memory of 4612	3068	b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74.exe	b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74.exe
PID 3068 wrote to memory of 4612	3068	b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74.exe	b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74.exe
PID 3068 wrote to memory of 4612	3068	b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74.exe	b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74.exe
PID 3068 wrote to memory of 4612	3068	b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74.exe	b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74.exe
PID 3068 wrote to memory of 4612	3068	b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74.exe	b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74.exe
PID 3068 wrote to memory of 4612	3068	b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74.exe	b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74.exe
PID 3068 wrote to memory of 4612	3068	b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74.exe	b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74.exe

C:\Users\Admin\AppData\Local\Temp\b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74.exe
"C:\Users\Admin\AppData\Local\Temp\b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3068

C:\Users\Admin\AppData\Local\Temp\b8093aa193ae7b4ca26ff113878eb1b09058d27f4d09821ece23ef068abebd74.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4612-132-0x0000000000000000-mapping.dmp

Download
memory/4612-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4612-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4612-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4612-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4612-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4612-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download