Analysis
-
max time kernel
74s -
max time network
83s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 11:56
Static task
static1
Behavioral task
behavioral1
Sample
bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exe
Resource
win10v2004-20220812-en
General
-
Target
bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exe
-
Size
518KB
-
MD5
06c51e79d0a7d35cdd67b553c439250c
-
SHA1
41fc1e4da45cf0fdb578d8843a009bbbe2182f3e
-
SHA256
bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44
-
SHA512
d96c4b958853964860d027ea9bd19fc3f0d21cb6dece5bd501bcfedf7650bd73e7b4f591e5fe15f5bc75579b4c9f27f73c96a37503b0768a708f34cbf39f6e27
-
SSDEEP
6144:uLu/LbMLThW2Qu52FKRBMxB9R4SQo+7zGLlw75G9+lLPX9MM8e459KOoWqe6w58U:uWaKKPMhxpLwYYlLPt5oKnWq3mb
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exedescription pid process target process PID 996 wrote to memory of 560 996 bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exe bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exe PID 996 wrote to memory of 560 996 bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exe bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exe PID 996 wrote to memory of 560 996 bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exe bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exe PID 996 wrote to memory of 560 996 bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exe bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exe PID 996 wrote to memory of 560 996 bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exe bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exe PID 996 wrote to memory of 560 996 bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exe bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exe PID 996 wrote to memory of 560 996 bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exe bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exe PID 996 wrote to memory of 1656 996 bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exe bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exe PID 996 wrote to memory of 1656 996 bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exe bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exe PID 996 wrote to memory of 1656 996 bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exe bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exe PID 996 wrote to memory of 1656 996 bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exe bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exe PID 996 wrote to memory of 1656 996 bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exe bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exe PID 996 wrote to memory of 1656 996 bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exe bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exe PID 996 wrote to memory of 1656 996 bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exe bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exe"C:\Users\Admin\AppData\Local\Temp\bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exestart2⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\bba830bbc2f48e9c9751386eae9acf0a0a6bcab949df57074e19d8e2f8120d44.exewatch2⤵PID:1656
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/560-56-0x0000000000000000-mapping.dmp
-
memory/560-61-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/560-63-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/560-64-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/996-54-0x00000000760B1000-0x00000000760B3000-memory.dmpFilesize
8KB
-
memory/996-57-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1656-55-0x0000000000000000-mapping.dmp
-
memory/1656-60-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1656-62-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1656-65-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB