Analysis
-
max time kernel
33s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 12:53
Static task
static1
Behavioral task
behavioral1
Sample
e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exe
Resource
win10v2004-20221111-en
General
-
Target
e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exe
-
Size
522KB
-
MD5
065d77a9d6a045035ff2605ecd7923a5
-
SHA1
4300026de64b318e0dfb06d4b477c67fda947893
-
SHA256
e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9
-
SHA512
17428ed74950b670e280fa77213aec21a603147ca407d771e54e1db9b98bd52a1548f18ab86e6f2a06bc402c3f58592bc6572d24256b7cba68f5798868cd5228
-
SSDEEP
12288:gODIuegPVCDASGXKFuLu2OOlOu/Qy18xQqpx8O5Bk:/93AkVXKILTOk/Qatqpx8
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exedescription pid process target process PID 1752 wrote to memory of 1728 1752 e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exe e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exe PID 1752 wrote to memory of 1728 1752 e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exe e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exe PID 1752 wrote to memory of 1728 1752 e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exe e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exe PID 1752 wrote to memory of 1728 1752 e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exe e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exe PID 1752 wrote to memory of 1728 1752 e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exe e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exe PID 1752 wrote to memory of 1728 1752 e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exe e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exe PID 1752 wrote to memory of 1728 1752 e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exe e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exe PID 1752 wrote to memory of 804 1752 e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exe e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exe PID 1752 wrote to memory of 804 1752 e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exe e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exe PID 1752 wrote to memory of 804 1752 e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exe e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exe PID 1752 wrote to memory of 804 1752 e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exe e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exe PID 1752 wrote to memory of 804 1752 e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exe e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exe PID 1752 wrote to memory of 804 1752 e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exe e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exe PID 1752 wrote to memory of 804 1752 e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exe e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exe"C:\Users\Admin\AppData\Local\Temp\e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exestart2⤵
-
C:\Users\Admin\AppData\Local\Temp\e1b142a0663de57408e68ba951436f96fce6c1d4127410ff60f58c39fa2e65b9.exewatch2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/804-56-0x0000000000000000-mapping.dmp
-
memory/804-59-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/804-63-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/804-66-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1728-57-0x0000000000000000-mapping.dmp
-
memory/1728-60-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1728-64-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1728-65-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1752-54-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1752-55-0x0000000075931000-0x0000000075933000-memory.dmpFilesize
8KB
-
memory/1752-58-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB