Analysis
-
max time kernel
91s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 12:56
Static task
static1
Behavioral task
behavioral1
Sample
db0f8a89e7607eaee8222172dcfc6dc2b6a737161b7b7e8163bbe616f3bac413.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
db0f8a89e7607eaee8222172dcfc6dc2b6a737161b7b7e8163bbe616f3bac413.exe
Resource
win10v2004-20220901-en
General
-
Target
db0f8a89e7607eaee8222172dcfc6dc2b6a737161b7b7e8163bbe616f3bac413.exe
-
Size
522KB
-
MD5
c491be92c8c770d12f39843745aced0e
-
SHA1
94354aec1822dc58edfd13226b4df61b7ad5d2ca
-
SHA256
db0f8a89e7607eaee8222172dcfc6dc2b6a737161b7b7e8163bbe616f3bac413
-
SHA512
7aa13fc2edc077a25a53ca7ab49f5ed10856f840afb68364ffb344e476a968c82763fb6163dabe81e23a18433492ecf11d22da597f58a2858c763493ba926a2c
-
SSDEEP
12288:W5MCze2kWCPdbOUvVhD5Aq1y18xQqpx8O5P:MW0ClbhhDJ1atqpx8
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
db0f8a89e7607eaee8222172dcfc6dc2b6a737161b7b7e8163bbe616f3bac413.exedescription pid process target process PID 5004 wrote to memory of 4148 5004 db0f8a89e7607eaee8222172dcfc6dc2b6a737161b7b7e8163bbe616f3bac413.exe db0f8a89e7607eaee8222172dcfc6dc2b6a737161b7b7e8163bbe616f3bac413.exe PID 5004 wrote to memory of 4148 5004 db0f8a89e7607eaee8222172dcfc6dc2b6a737161b7b7e8163bbe616f3bac413.exe db0f8a89e7607eaee8222172dcfc6dc2b6a737161b7b7e8163bbe616f3bac413.exe PID 5004 wrote to memory of 4148 5004 db0f8a89e7607eaee8222172dcfc6dc2b6a737161b7b7e8163bbe616f3bac413.exe db0f8a89e7607eaee8222172dcfc6dc2b6a737161b7b7e8163bbe616f3bac413.exe PID 5004 wrote to memory of 4124 5004 db0f8a89e7607eaee8222172dcfc6dc2b6a737161b7b7e8163bbe616f3bac413.exe db0f8a89e7607eaee8222172dcfc6dc2b6a737161b7b7e8163bbe616f3bac413.exe PID 5004 wrote to memory of 4124 5004 db0f8a89e7607eaee8222172dcfc6dc2b6a737161b7b7e8163bbe616f3bac413.exe db0f8a89e7607eaee8222172dcfc6dc2b6a737161b7b7e8163bbe616f3bac413.exe PID 5004 wrote to memory of 4124 5004 db0f8a89e7607eaee8222172dcfc6dc2b6a737161b7b7e8163bbe616f3bac413.exe db0f8a89e7607eaee8222172dcfc6dc2b6a737161b7b7e8163bbe616f3bac413.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\db0f8a89e7607eaee8222172dcfc6dc2b6a737161b7b7e8163bbe616f3bac413.exe"C:\Users\Admin\AppData\Local\Temp\db0f8a89e7607eaee8222172dcfc6dc2b6a737161b7b7e8163bbe616f3bac413.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\db0f8a89e7607eaee8222172dcfc6dc2b6a737161b7b7e8163bbe616f3bac413.exestart2⤵
-
C:\Users\Admin\AppData\Local\Temp\db0f8a89e7607eaee8222172dcfc6dc2b6a737161b7b7e8163bbe616f3bac413.exewatch2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4124-133-0x0000000000000000-mapping.dmp
-
memory/4124-136-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4124-138-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4124-141-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4148-134-0x0000000000000000-mapping.dmp
-
memory/4148-137-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4148-139-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4148-140-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/5004-132-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/5004-135-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB