89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88

Analysis

max time kernel
224s
max time network
304s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88.exe
Size

1.3MB
MD5

2c02070878e8ceefd73eda45816c85d0
SHA1

eff8eecbab8bb7ef732194cdcf7b3d486b37fd7c
SHA256

89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88
SHA512

93a511caa62597ac2e4dc27459428aaaacb07ea73d5d7e3b99a8ffa8172e1e2ece5c01581eceaab5d497c4d39d177a2658bf960cb267bc3b773630fbc0ed6e28
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakP:zrKo4ZwCOnYjVmJPaY

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88.exe

description	pid	process	target process
PID 3000 set thread context of 1736	3000	89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88.exe	89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88.exe

pid	process
1736	89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88.exe
1736	89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88.exe
1736	89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88.exe
1736	89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88.exe
1736	89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88.exe

description	pid	process	target process
PID 3000 wrote to memory of 1736	3000	89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88.exe	89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88.exe
PID 3000 wrote to memory of 1736	3000	89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88.exe	89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88.exe
PID 3000 wrote to memory of 1736	3000	89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88.exe	89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88.exe
PID 3000 wrote to memory of 1736	3000	89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88.exe	89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88.exe
PID 3000 wrote to memory of 1736	3000	89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88.exe	89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88.exe
PID 3000 wrote to memory of 1736	3000	89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88.exe	89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88.exe
PID 3000 wrote to memory of 1736	3000	89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88.exe	89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88.exe
PID 3000 wrote to memory of 1736	3000	89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88.exe	89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88.exe
PID 3000 wrote to memory of 1736	3000	89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88.exe	89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88.exe
PID 3000 wrote to memory of 1736	3000	89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88.exe	89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88.exe

C:\Users\Admin\AppData\Local\Temp\89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88.exe
"C:\Users\Admin\AppData\Local\Temp\89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3000

C:\Users\Admin\AppData\Local\Temp\89878871159152555b142091ce107dd8a3c0bffa1fd66b02d2c0e0ed1647cb88.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:1736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1736-132-0x0000000000000000-mapping.dmp

Download
memory/1736-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1736-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1736-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1736-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1736-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download