Analysis
-
max time kernel
168s -
max time network
195s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 11:15
Static task
static1
Behavioral task
behavioral1
Sample
95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exe
Resource
win10v2004-20221111-en
General
-
Target
95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exe
-
Size
1.3MB
-
MD5
035fbaf9a6b576645f1474e609711b36
-
SHA1
1f1723b3ffa76ecd4cb6986a26be6b970078e2db
-
SHA256
95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276
-
SHA512
256ba74b29b43740f6b8fb417c8f29660ef7103aadd711016957c0aa1fb4831df7637a2321e59a803ae58617a191e2952238aa763ff1851d12fa5df904a262a7
-
SSDEEP
24576:jrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak1:jrKo4ZwCOnYjVmJPaW
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exedescription pid process target process PID 1324 set thread context of 2016 1324 95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exe 95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exepid process 2016 95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exe 2016 95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exe 2016 95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exe 2016 95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exe 2016 95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exedescription pid process target process PID 1324 wrote to memory of 2016 1324 95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exe 95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exe PID 1324 wrote to memory of 2016 1324 95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exe 95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exe PID 1324 wrote to memory of 2016 1324 95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exe 95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exe PID 1324 wrote to memory of 2016 1324 95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exe 95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exe PID 1324 wrote to memory of 2016 1324 95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exe 95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exe PID 1324 wrote to memory of 2016 1324 95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exe 95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exe PID 1324 wrote to memory of 2016 1324 95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exe 95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exe PID 1324 wrote to memory of 2016 1324 95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exe 95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exe PID 1324 wrote to memory of 2016 1324 95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exe 95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exe PID 1324 wrote to memory of 2016 1324 95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exe 95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exe"C:\Users\Admin\AppData\Local\Temp\95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\95cada77ec122b683d9d6543c8419da797a81593eb58d5ab92cd289dd525a276.exe
- Suspicious use of SetWindowsHookEx
PID:2016
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2016-132-0x0000000000000000-mapping.dmp
-
memory/2016-133-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/2016-134-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/2016-135-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/2016-136-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/2016-137-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB