Analysis
-
max time kernel
187s -
max time network
200s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 11:50
Static task
static1
Behavioral task
behavioral1
Sample
e7104d06d8cf3a64b3a937e79f33274b1ebcce3f657942b0eb03e03f0178f31f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e7104d06d8cf3a64b3a937e79f33274b1ebcce3f657942b0eb03e03f0178f31f.exe
Resource
win10v2004-20221111-en
General
-
Target
e7104d06d8cf3a64b3a937e79f33274b1ebcce3f657942b0eb03e03f0178f31f.exe
-
Size
522KB
-
MD5
e8271fb26d4c283ed9b78e290911f98e
-
SHA1
1a7e82425c13c70dffd6d6a48ee86b944d320a57
-
SHA256
e7104d06d8cf3a64b3a937e79f33274b1ebcce3f657942b0eb03e03f0178f31f
-
SHA512
cda1844157950506fa1b639997f567c2e608afa2fe5a89ab5ef41a37803fe2f908946e48445b081c28c76a5c964ed68fa608e073b4158d5c1940e895d9f9cb75
-
SSDEEP
12288:nSC6kpjRdWz5ma93UdcyMy18xQqpx8O52:SCPJzaUKatqpx8
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
e7104d06d8cf3a64b3a937e79f33274b1ebcce3f657942b0eb03e03f0178f31f.exedescription pid process target process PID 2204 wrote to memory of 1440 2204 e7104d06d8cf3a64b3a937e79f33274b1ebcce3f657942b0eb03e03f0178f31f.exe e7104d06d8cf3a64b3a937e79f33274b1ebcce3f657942b0eb03e03f0178f31f.exe PID 2204 wrote to memory of 1440 2204 e7104d06d8cf3a64b3a937e79f33274b1ebcce3f657942b0eb03e03f0178f31f.exe e7104d06d8cf3a64b3a937e79f33274b1ebcce3f657942b0eb03e03f0178f31f.exe PID 2204 wrote to memory of 1440 2204 e7104d06d8cf3a64b3a937e79f33274b1ebcce3f657942b0eb03e03f0178f31f.exe e7104d06d8cf3a64b3a937e79f33274b1ebcce3f657942b0eb03e03f0178f31f.exe PID 2204 wrote to memory of 4252 2204 e7104d06d8cf3a64b3a937e79f33274b1ebcce3f657942b0eb03e03f0178f31f.exe e7104d06d8cf3a64b3a937e79f33274b1ebcce3f657942b0eb03e03f0178f31f.exe PID 2204 wrote to memory of 4252 2204 e7104d06d8cf3a64b3a937e79f33274b1ebcce3f657942b0eb03e03f0178f31f.exe e7104d06d8cf3a64b3a937e79f33274b1ebcce3f657942b0eb03e03f0178f31f.exe PID 2204 wrote to memory of 4252 2204 e7104d06d8cf3a64b3a937e79f33274b1ebcce3f657942b0eb03e03f0178f31f.exe e7104d06d8cf3a64b3a937e79f33274b1ebcce3f657942b0eb03e03f0178f31f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7104d06d8cf3a64b3a937e79f33274b1ebcce3f657942b0eb03e03f0178f31f.exe"C:\Users\Admin\AppData\Local\Temp\e7104d06d8cf3a64b3a937e79f33274b1ebcce3f657942b0eb03e03f0178f31f.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e7104d06d8cf3a64b3a937e79f33274b1ebcce3f657942b0eb03e03f0178f31f.exestart2⤵
-
C:\Users\Admin\AppData\Local\Temp\e7104d06d8cf3a64b3a937e79f33274b1ebcce3f657942b0eb03e03f0178f31f.exewatch2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1440-134-0x0000000000000000-mapping.dmp
-
memory/1440-137-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1440-139-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1440-140-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2204-132-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2204-135-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4252-133-0x0000000000000000-mapping.dmp
-
memory/4252-136-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4252-138-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4252-141-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB