Analysis
-
max time kernel
147s -
max time network
195s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 11:54
Static task
static1
Behavioral task
behavioral1
Sample
ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe
Resource
win10v2004-20221111-en
General
-
Target
ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe
-
Size
522KB
-
MD5
6cbb8d559eee6483a9b5e82f8d35cf3c
-
SHA1
1c9182874ab594a2710a0780d4c712e201fd78c9
-
SHA256
ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9
-
SHA512
4dbbcc0289461153fc3ae0d13a6dbb119ab8820b34bfe61e8ab09251691325ea73b8b46365a555d7b537973b62e3fc32567d0e26581d8ad3dcd76cf5c4328e9c
-
SSDEEP
6144:XahbsJ+yBQ9vc/4XCUKwraCD333xVkmhdTDh70QfuMTf4pv/mQy1CrxQqD9RSaSj:I9z6CbHkmbDeQfuYENy18xQqpx8O5ws
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exedescription pid process target process PID 2800 wrote to memory of 4908 2800 ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe PID 2800 wrote to memory of 4908 2800 ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe PID 2800 wrote to memory of 4908 2800 ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe PID 2800 wrote to memory of 3796 2800 ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe PID 2800 wrote to memory of 3796 2800 ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe PID 2800 wrote to memory of 3796 2800 ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe"C:\Users\Admin\AppData\Local\Temp\ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exestart2⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\ca5c6ddfe9b018d8eb784043943d0d29de4df4f6329ab08c143fe8336b0103a9.exewatch2⤵PID:3796
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2800-132-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2800-135-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/3796-133-0x0000000000000000-mapping.dmp
-
memory/3796-136-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/3796-138-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/3796-141-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4908-134-0x0000000000000000-mapping.dmp
-
memory/4908-137-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4908-139-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4908-140-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB