Analysis
-
max time kernel
199s -
max time network
248s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 11:49
Static task
static1
Behavioral task
behavioral1
Sample
eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe
Resource
win10v2004-20221111-en
General
-
Target
eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe
-
Size
522KB
-
MD5
29dec5dc9d6ed6107d24a93431f98e1d
-
SHA1
0804fdc887a165d4d91973ec2c692fbf71ce1304
-
SHA256
eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f
-
SHA512
979020a7887b3b9655bec0b9b54a8396d0330e72b00109b027515b75a5533124106fd2f7246de874141972dd988fb47c5a87a7c7cfc2b912b4bfc3bb79e6beda
-
SSDEEP
12288:SKeMm7qprQgHkFfcIhOyCzxo4xUupSMrFCsNEfF4SD:SKe98QAj3pG4quouFCsNaHD
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exedescription pid process target process PID 1904 wrote to memory of 2580 1904 eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe PID 1904 wrote to memory of 2580 1904 eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe PID 1904 wrote to memory of 2580 1904 eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe PID 1904 wrote to memory of 4128 1904 eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe PID 1904 wrote to memory of 4128 1904 eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe PID 1904 wrote to memory of 4128 1904 eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe"C:\Users\Admin\AppData\Local\Temp\eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exewatch2⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\eb9553ee78f917710a1c847ec89db6dcc031bdf416fc4cb89235ae4bfd973f5f.exestart2⤵PID:2580
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1904-132-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1904-135-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2580-134-0x0000000000000000-mapping.dmp
-
memory/2580-137-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2580-139-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2580-140-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4128-133-0x0000000000000000-mapping.dmp
-
memory/4128-136-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4128-138-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4128-141-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB