9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11

Analysis

max time kernel
183s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11.exe
Size

1.3MB
MD5

825d7f0f83eb40274e10e1b7ff901df4
SHA1

49f3340f6c7eee01bb1ab3d24dc2776397770803
SHA256

9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11
SHA512

f2f920c3b48bb76a8e4ced4bf328e315b58b61c0e6420c869bedfc8e7dccb68e95d92d90b467bc002b8024adb788f69270973103f1d1616cd10d7e5907341a74
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakm:zrKo4ZwCOnYjVmJPah

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11.exe

description	pid	process	target process
PID 3372 set thread context of 2360	3372	9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11.exe	9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11.exe

pid	process
2360	9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11.exe
2360	9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11.exe
2360	9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11.exe
2360	9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11.exe
2360	9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11.exe

description	pid	process	target process
PID 3372 wrote to memory of 2360	3372	9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11.exe	9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11.exe
PID 3372 wrote to memory of 2360	3372	9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11.exe	9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11.exe
PID 3372 wrote to memory of 2360	3372	9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11.exe	9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11.exe
PID 3372 wrote to memory of 2360	3372	9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11.exe	9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11.exe
PID 3372 wrote to memory of 2360	3372	9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11.exe	9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11.exe
PID 3372 wrote to memory of 2360	3372	9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11.exe	9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11.exe
PID 3372 wrote to memory of 2360	3372	9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11.exe	9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11.exe
PID 3372 wrote to memory of 2360	3372	9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11.exe	9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11.exe
PID 3372 wrote to memory of 2360	3372	9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11.exe	9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11.exe
PID 3372 wrote to memory of 2360	3372	9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11.exe	9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11.exe

C:\Users\Admin\AppData\Local\Temp\9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11.exe
"C:\Users\Admin\AppData\Local\Temp\9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3372

C:\Users\Admin\AppData\Local\Temp\9090b5301878a17bd3b7212f56041b2884c5272e29c4870027385e70e66b3c11.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:2360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2360-132-0x0000000000000000-mapping.dmp

Download
memory/2360-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2360-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2360-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2360-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2360-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download