84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f

Analysis

max time kernel
145s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe
Size

1.2MB
MD5

6cbaf0512be332d20f54edbee669a3d6
SHA1

8fa1216241c5d2f3b4c3ebc95b74b60c17f8adcf
SHA256

84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f
SHA512

4a4b03c18e2b2c1dc5e7cb3c28f6877c21b84c2013e45c998b97e416e5797e9c192e92d44db343e970d405a8d124372328b580b73c72527fa6ebee33cce728dd
SSDEEP

12288:NSGxzDKw6w2qa3LgMc8SLFDY/8LeS2899E7D3AYNACMzb7noKcxl4B6obXWRAfbx:Mxw8wFDY3wE3wY6cxI6gWUbIwMLHf/Y

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe

description	pid	process	target process
PID 2236 set thread context of 3920	2236	84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe	84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe

pid	process
3920	84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe
3920	84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe
3920	84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe
3920	84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe
3920	84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe

description	pid	process	target process
PID 2236 wrote to memory of 3920	2236	84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe	84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe
PID 2236 wrote to memory of 3920	2236	84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe	84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe
PID 2236 wrote to memory of 3920	2236	84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe	84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe
PID 2236 wrote to memory of 3920	2236	84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe	84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe
PID 2236 wrote to memory of 3920	2236	84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe	84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe
PID 2236 wrote to memory of 3920	2236	84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe	84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe
PID 2236 wrote to memory of 3920	2236	84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe	84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe
PID 2236 wrote to memory of 3920	2236	84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe	84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe
PID 2236 wrote to memory of 3920	2236	84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe	84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe
PID 2236 wrote to memory of 3920	2236	84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe	84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe

C:\Users\Admin\AppData\Local\Temp\84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe
"C:\Users\Admin\AppData\Local\Temp\84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2236

C:\Users\Admin\AppData\Local\Temp\84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe
"C:\Users\Admin\AppData\Local\Temp\84b6e5962359049e1d69a77ab8e2e159abcf35251cc3850f51c09ee51213403f.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:3920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3920-132-0x0000000000000000-mapping.dmp

Download
memory/3920-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/3920-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/3920-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/3920-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/3920-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/3920-138-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download