Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 10:44
Static task
static1
Behavioral task
behavioral1
Sample
85725666c07369c0125511f600cef6d62beceb0c69ee056f1c502dcfcb27316e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
85725666c07369c0125511f600cef6d62beceb0c69ee056f1c502dcfcb27316e.exe
Resource
win10v2004-20220812-en
General
-
Target
85725666c07369c0125511f600cef6d62beceb0c69ee056f1c502dcfcb27316e.exe
-
Size
255KB
-
MD5
e161743ebb2891f20e5a471eb9fced4b
-
SHA1
4369ba4640dc99bb9285418144206a6fc410589f
-
SHA256
85725666c07369c0125511f600cef6d62beceb0c69ee056f1c502dcfcb27316e
-
SHA512
ca0d0152350231e0bde94581f8baf231a79d26775e215deaaea2eca1fbbce6f257ddd0e7ff8d55c160e6eed265a61c600653d29b2b175310c70d5e1f95123c2b
-
SSDEEP
6144:Rc/V6UUbgPjmx77H3sdQ9a/IdPoS4cmFugtK/MeWM:+V6UUULmVXc+AtFS
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
85725666c07369c0125511f600cef6d62beceb0c69ee056f1c502dcfcb27316e.exedescription pid process target process PID 1800 set thread context of 2012 1800 85725666c07369c0125511f600cef6d62beceb0c69ee056f1c502dcfcb27316e.exe 85725666c07369c0125511f600cef6d62beceb0c69ee056f1c502dcfcb27316e.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
85725666c07369c0125511f600cef6d62beceb0c69ee056f1c502dcfcb27316e.exedescription pid process target process PID 1800 wrote to memory of 2012 1800 85725666c07369c0125511f600cef6d62beceb0c69ee056f1c502dcfcb27316e.exe 85725666c07369c0125511f600cef6d62beceb0c69ee056f1c502dcfcb27316e.exe PID 1800 wrote to memory of 2012 1800 85725666c07369c0125511f600cef6d62beceb0c69ee056f1c502dcfcb27316e.exe 85725666c07369c0125511f600cef6d62beceb0c69ee056f1c502dcfcb27316e.exe PID 1800 wrote to memory of 2012 1800 85725666c07369c0125511f600cef6d62beceb0c69ee056f1c502dcfcb27316e.exe 85725666c07369c0125511f600cef6d62beceb0c69ee056f1c502dcfcb27316e.exe PID 1800 wrote to memory of 2012 1800 85725666c07369c0125511f600cef6d62beceb0c69ee056f1c502dcfcb27316e.exe 85725666c07369c0125511f600cef6d62beceb0c69ee056f1c502dcfcb27316e.exe PID 1800 wrote to memory of 2012 1800 85725666c07369c0125511f600cef6d62beceb0c69ee056f1c502dcfcb27316e.exe 85725666c07369c0125511f600cef6d62beceb0c69ee056f1c502dcfcb27316e.exe PID 1800 wrote to memory of 2012 1800 85725666c07369c0125511f600cef6d62beceb0c69ee056f1c502dcfcb27316e.exe 85725666c07369c0125511f600cef6d62beceb0c69ee056f1c502dcfcb27316e.exe PID 1800 wrote to memory of 2012 1800 85725666c07369c0125511f600cef6d62beceb0c69ee056f1c502dcfcb27316e.exe 85725666c07369c0125511f600cef6d62beceb0c69ee056f1c502dcfcb27316e.exe PID 1800 wrote to memory of 2012 1800 85725666c07369c0125511f600cef6d62beceb0c69ee056f1c502dcfcb27316e.exe 85725666c07369c0125511f600cef6d62beceb0c69ee056f1c502dcfcb27316e.exe PID 1800 wrote to memory of 2012 1800 85725666c07369c0125511f600cef6d62beceb0c69ee056f1c502dcfcb27316e.exe 85725666c07369c0125511f600cef6d62beceb0c69ee056f1c502dcfcb27316e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\85725666c07369c0125511f600cef6d62beceb0c69ee056f1c502dcfcb27316e.exe"C:\Users\Admin\AppData\Local\Temp\85725666c07369c0125511f600cef6d62beceb0c69ee056f1c502dcfcb27316e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\85725666c07369c0125511f600cef6d62beceb0c69ee056f1c502dcfcb27316e.exe"C:\Users\Admin\AppData\Local\Temp\85725666c07369c0125511f600cef6d62beceb0c69ee056f1c502dcfcb27316e.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2012-55-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/2012-54-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/2012-57-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/2012-58-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/2012-60-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/2012-61-0x0000000000431055-mapping.dmp
-
memory/2012-63-0x00000000758C1000-0x00000000758C3000-memory.dmpFilesize
8KB
-
memory/2012-64-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB