Analysis
-
max time kernel
62s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 11:49
Static task
static1
Behavioral task
behavioral1
Sample
eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe
Resource
win10v2004-20221111-en
General
-
Target
eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe
-
Size
522KB
-
MD5
29dec5dc9d6ed6107d24a93431f98e1d
-
SHA1
0804fdc887a165d4d91973ec2c692fbf71ce1304
-
SHA256
eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f
-
SHA512
979020a7887b3b9655bec0b9b54a8396d0330e72b00109b027515b75a5533124106fd2f7246de874141972dd988fb47c5a87a7c7cfc2b912b4bfc3bb79e6beda
-
SSDEEP
12288:SKeMm7qprQgHkFfcIhOyCzxo4xUupSMrFCsNEfF4SD:SKe98QAj3pG4quouFCsNaHD
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exedescription pid process target process PID 1184 wrote to memory of 1780 1184 eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe PID 1184 wrote to memory of 1780 1184 eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe PID 1184 wrote to memory of 1780 1184 eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe PID 1184 wrote to memory of 1780 1184 eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe PID 1184 wrote to memory of 1780 1184 eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe PID 1184 wrote to memory of 1780 1184 eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe PID 1184 wrote to memory of 1780 1184 eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe PID 1184 wrote to memory of 1240 1184 eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe PID 1184 wrote to memory of 1240 1184 eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe PID 1184 wrote to memory of 1240 1184 eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe PID 1184 wrote to memory of 1240 1184 eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe PID 1184 wrote to memory of 1240 1184 eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe PID 1184 wrote to memory of 1240 1184 eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe PID 1184 wrote to memory of 1240 1184 eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe"C:\Users\Admin\AppData\Local\Temp\eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exestart2⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exewatch2⤵PID:1240
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1184-54-0x0000000074FD1000-0x0000000074FD3000-memory.dmpFilesize
8KB
-
memory/1184-57-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1240-55-0x0000000000000000-mapping.dmp
-
memory/1240-59-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1240-62-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1240-64-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1780-56-0x0000000000000000-mapping.dmp
-
memory/1780-61-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1780-63-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB