Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 11:59
Static task
static1
Behavioral task
behavioral1
Sample
7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exe
Resource
win10v2004-20220812-en
General
-
Target
7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exe
-
Size
1.6MB
-
MD5
339fafb2a6b310ebfeede97eac5c0e4e
-
SHA1
5a4b2d5f0308bf17a571d7c60fe187a43f0aa3db
-
SHA256
7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833
-
SHA512
3cb3e597244902ae37a109de62209c2f2f1ab3cec9bd729fb44c1b4bce246fababac8df832e7368bcec93c724919c49e32a798db823397e015f7f0ec36bde645
-
SSDEEP
24576:9zD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUYP:X6/ye0PIphrp9Zuvjqa0Uid8
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exedescription pid process target process PID 2148 set thread context of 4428 2148 7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exe 7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exepid process 4428 7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exe 4428 7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exe 4428 7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exe 4428 7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exe 4428 7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exedescription pid process target process PID 2148 wrote to memory of 4428 2148 7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exe 7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exe PID 2148 wrote to memory of 4428 2148 7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exe 7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exe PID 2148 wrote to memory of 4428 2148 7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exe 7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exe PID 2148 wrote to memory of 4428 2148 7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exe 7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exe PID 2148 wrote to memory of 4428 2148 7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exe 7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exe PID 2148 wrote to memory of 4428 2148 7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exe 7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exe PID 2148 wrote to memory of 4428 2148 7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exe 7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exe PID 2148 wrote to memory of 4428 2148 7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exe 7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exe PID 2148 wrote to memory of 4428 2148 7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exe 7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exe PID 2148 wrote to memory of 4428 2148 7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exe 7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exe"C:\Users\Admin\AppData\Local\Temp\7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exe"C:\Users\Admin\AppData\Local\Temp\7c53dea4b48d9067a2ca9788bb5918d41b7744d59ba8b231c7c4e1a78215d833.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:4428
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4428-132-0x0000000000000000-mapping.dmp
-
memory/4428-134-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/4428-133-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/4428-135-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/4428-136-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/4428-137-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB