Analysis
-
max time kernel
41s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 11:54
Static task
static1
Behavioral task
behavioral1
Sample
ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe
Resource
win10v2004-20221111-en
General
-
Target
ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe
-
Size
522KB
-
MD5
6cbb8d559eee6483a9b5e82f8d35cf3c
-
SHA1
1c9182874ab594a2710a0780d4c712e201fd78c9
-
SHA256
ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9
-
SHA512
4dbbcc0289461153fc3ae0d13a6dbb119ab8820b34bfe61e8ab09251691325ea73b8b46365a555d7b537973b62e3fc32567d0e26581d8ad3dcd76cf5c4328e9c
-
SSDEEP
6144:XahbsJ+yBQ9vc/4XCUKwraCD333xVkmhdTDh70QfuMTf4pv/mQy1CrxQqD9RSaSj:I9z6CbHkmbDeQfuYENy18xQqpx8O5ws
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exedescription pid process target process PID 1416 wrote to memory of 1348 1416 ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe PID 1416 wrote to memory of 1348 1416 ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe PID 1416 wrote to memory of 1348 1416 ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe PID 1416 wrote to memory of 1348 1416 ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe PID 1416 wrote to memory of 1348 1416 ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe PID 1416 wrote to memory of 1348 1416 ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe PID 1416 wrote to memory of 1348 1416 ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe PID 1416 wrote to memory of 2036 1416 ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe PID 1416 wrote to memory of 2036 1416 ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe PID 1416 wrote to memory of 2036 1416 ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe PID 1416 wrote to memory of 2036 1416 ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe PID 1416 wrote to memory of 2036 1416 ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe PID 1416 wrote to memory of 2036 1416 ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe PID 1416 wrote to memory of 2036 1416 ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe"C:\Users\Admin\AppData\Local\Temp\ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exestart2⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exewatch2⤵PID:2036
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1348-56-0x0000000000000000-mapping.dmp
-
memory/1348-59-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1348-63-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1348-64-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1416-54-0x0000000075F01000-0x0000000075F03000-memory.dmpFilesize
8KB
-
memory/1416-57-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2036-55-0x0000000000000000-mapping.dmp
-
memory/2036-58-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2036-62-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2036-65-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB