Analysis

  • max time kernel
    153s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 10:46

General

  • Target

    6678ff966e942e4bf669d8a240acbab79971c871152f3c16478a3ec0c3f5c805.exe

  • Size

    140KB

  • MD5

    72f8875552ce183d41ad016af06be683

  • SHA1

    e50b9dde42ce3aa8c5387dbaaeacd0b2af76962a

  • SHA256

    6678ff966e942e4bf669d8a240acbab79971c871152f3c16478a3ec0c3f5c805

  • SHA512

    f88dad25ea449ee7940a2c9c7892ba0363bff87796fd7ca794b1538ecccc31060e685305110cf9b65b14c1253fc010d419ee1a9205aff5ff5b43901f267bc478

  • SSDEEP

    3072:b30yC722pItB7Lin2IaQP2mNVeAn5o0hEXk1PX:b30j2iItBO0GDfF

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6678ff966e942e4bf669d8a240acbab79971c871152f3c16478a3ec0c3f5c805.exe
    "C:\Users\Admin\AppData\Local\Temp\6678ff966e942e4bf669d8a240acbab79971c871152f3c16478a3ec0c3f5c805.exe"
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2872
    • C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      2⤵
      • Adds Run key to start application
      PID:2124

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2124-132-0x0000000000000000-mapping.dmp

  • memory/2124-134-0x0000000000330000-0x000000000033E000-memory.dmp

    Filesize

    56KB

  • memory/2124-135-0x00000000001C0000-0x00000000001D1000-memory.dmp

    Filesize

    68KB

  • memory/2124-136-0x0000000000380000-0x0000000000400000-memory.dmp

    Filesize

    512KB

  • memory/2124-137-0x0000000000380000-0x0000000000400000-memory.dmp

    Filesize

    512KB

  • memory/2872-133-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB