Analysis
-
max time kernel
33s -
max time network
58s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 11:54
Static task
static1
Behavioral task
behavioral1
Sample
cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exe
Resource
win10v2004-20221111-en
General
-
Target
cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exe
-
Size
526KB
-
MD5
4ee77a8ee4a37222a07b84e77b5942c0
-
SHA1
57c4f3ca618a3e51399eecfd672c33050efc13e6
-
SHA256
cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64
-
SHA512
6b99ca97ce888e9e6398ae23970225a00b0c743e523a946d6e89fa80fac952106a9d08a80a269262249da61b0eccb159e8ac301de73bf4fd0cf8d75e8fb629b2
-
SSDEEP
6144:1kFjhLSWwQwcyx1mu8fMQPa16s8TzG/wQp7EjABmQy1CrxQqD9RSaSz+8O5DEtVF:yFJVYePgJp1y18xQqpx8O5DEtT
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exedescription pid process target process PID 1368 wrote to memory of 1620 1368 cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exe cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exe PID 1368 wrote to memory of 1620 1368 cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exe cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exe PID 1368 wrote to memory of 1620 1368 cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exe cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exe PID 1368 wrote to memory of 1620 1368 cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exe cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exe PID 1368 wrote to memory of 1620 1368 cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exe cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exe PID 1368 wrote to memory of 1620 1368 cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exe cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exe PID 1368 wrote to memory of 1620 1368 cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exe cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exe PID 1368 wrote to memory of 1612 1368 cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exe cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exe PID 1368 wrote to memory of 1612 1368 cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exe cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exe PID 1368 wrote to memory of 1612 1368 cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exe cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exe PID 1368 wrote to memory of 1612 1368 cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exe cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exe PID 1368 wrote to memory of 1612 1368 cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exe cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exe PID 1368 wrote to memory of 1612 1368 cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exe cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exe PID 1368 wrote to memory of 1612 1368 cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exe cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exe"C:\Users\Admin\AppData\Local\Temp\cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exestart2⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\cb9aabe67e0c296f8a172a7983192e6cde874562424953fff0b9d5d2ab1eff64.exewatch2⤵PID:1612
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1368-54-0x0000000075501000-0x0000000075503000-memory.dmpFilesize
8KB
-
memory/1368-57-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1612-55-0x0000000000000000-mapping.dmp
-
memory/1612-58-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1612-62-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1612-65-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1620-56-0x0000000000000000-mapping.dmp
-
memory/1620-59-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1620-63-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1620-64-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB