8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168

Analysis

max time kernel
70s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168.exe
Size

1.3MB
MD5

ccf0ac2852140ecda8fa47156c795a26
SHA1

1381c1f72b73da1b3258af4be4251637bb7f6203
SHA256

8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168
SHA512

00037ff8c58805e8fa1c815d27d145626afb03b3a76b1f2c28d34efbbdb2275032c43c99e838e303d54826f4b7d43ef1710c1ad4e9151f8c947401190f0f374b
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak:7rKo4ZwCOnYjVmJPa

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168.exe

description	pid	process	target process
PID 3400 set thread context of 644	3400	8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168.exe	8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168.exe

pid	process
644	8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168.exe
644	8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168.exe
644	8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168.exe
644	8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168.exe
644	8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168.exe

description	pid	process	target process
PID 3400 wrote to memory of 644	3400	8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168.exe	8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168.exe
PID 3400 wrote to memory of 644	3400	8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168.exe	8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168.exe
PID 3400 wrote to memory of 644	3400	8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168.exe	8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168.exe
PID 3400 wrote to memory of 644	3400	8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168.exe	8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168.exe
PID 3400 wrote to memory of 644	3400	8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168.exe	8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168.exe
PID 3400 wrote to memory of 644	3400	8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168.exe	8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168.exe
PID 3400 wrote to memory of 644	3400	8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168.exe	8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168.exe
PID 3400 wrote to memory of 644	3400	8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168.exe	8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168.exe
PID 3400 wrote to memory of 644	3400	8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168.exe	8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168.exe
PID 3400 wrote to memory of 644	3400	8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168.exe	8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168.exe

C:\Users\Admin\AppData\Local\Temp\8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168.exe
"C:\Users\Admin\AppData\Local\Temp\8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3400

C:\Users\Admin\AppData\Local\Temp\8bfce661b5fb1aba67134ffb15f19a9f3d7df69996d119713de1134068673168.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/644-132-0x0000000000000000-mapping.dmp

Download
memory/644-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/644-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/644-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/644-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/644-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/644-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download