Analysis
-
max time kernel
91s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 12:09
Static task
static1
Behavioral task
behavioral1
Sample
6caa4cf41146f10276b1119caf35aa7c726032f400c0c8a2f1be2874702e24cb.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6caa4cf41146f10276b1119caf35aa7c726032f400c0c8a2f1be2874702e24cb.exe
Resource
win10v2004-20220901-en
General
-
Target
6caa4cf41146f10276b1119caf35aa7c726032f400c0c8a2f1be2874702e24cb.exe
-
Size
526KB
-
MD5
1ae7c99ca564ccfd3e6b787d30a3b69d
-
SHA1
e939d4a500d55c8f328063fa3043b7a6a8a88511
-
SHA256
6caa4cf41146f10276b1119caf35aa7c726032f400c0c8a2f1be2874702e24cb
-
SHA512
cd996659e97c203909afe3424d646588ad385ae5241ec65661af347611708c46c77f56db3d51715b353105aa6aefe2a254199bd11e0d7ecced2f204840e7c505
-
SSDEEP
6144:K+2rimjVcndimxiKBTPhaqz59Kh29xGWOQTTGRImQy1CrxQqD9RSaSz+8O5EQs:9PSKnc2T/e29xBO+OEy18xQqpx8O5Eh
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
6caa4cf41146f10276b1119caf35aa7c726032f400c0c8a2f1be2874702e24cb.exedescription pid process target process PID 4992 wrote to memory of 1672 4992 6caa4cf41146f10276b1119caf35aa7c726032f400c0c8a2f1be2874702e24cb.exe 6caa4cf41146f10276b1119caf35aa7c726032f400c0c8a2f1be2874702e24cb.exe PID 4992 wrote to memory of 1672 4992 6caa4cf41146f10276b1119caf35aa7c726032f400c0c8a2f1be2874702e24cb.exe 6caa4cf41146f10276b1119caf35aa7c726032f400c0c8a2f1be2874702e24cb.exe PID 4992 wrote to memory of 1672 4992 6caa4cf41146f10276b1119caf35aa7c726032f400c0c8a2f1be2874702e24cb.exe 6caa4cf41146f10276b1119caf35aa7c726032f400c0c8a2f1be2874702e24cb.exe PID 4992 wrote to memory of 2548 4992 6caa4cf41146f10276b1119caf35aa7c726032f400c0c8a2f1be2874702e24cb.exe 6caa4cf41146f10276b1119caf35aa7c726032f400c0c8a2f1be2874702e24cb.exe PID 4992 wrote to memory of 2548 4992 6caa4cf41146f10276b1119caf35aa7c726032f400c0c8a2f1be2874702e24cb.exe 6caa4cf41146f10276b1119caf35aa7c726032f400c0c8a2f1be2874702e24cb.exe PID 4992 wrote to memory of 2548 4992 6caa4cf41146f10276b1119caf35aa7c726032f400c0c8a2f1be2874702e24cb.exe 6caa4cf41146f10276b1119caf35aa7c726032f400c0c8a2f1be2874702e24cb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6caa4cf41146f10276b1119caf35aa7c726032f400c0c8a2f1be2874702e24cb.exe"C:\Users\Admin\AppData\Local\Temp\6caa4cf41146f10276b1119caf35aa7c726032f400c0c8a2f1be2874702e24cb.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6caa4cf41146f10276b1119caf35aa7c726032f400c0c8a2f1be2874702e24cb.exestart2⤵
-
C:\Users\Admin\AppData\Local\Temp\6caa4cf41146f10276b1119caf35aa7c726032f400c0c8a2f1be2874702e24cb.exewatch2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1672-134-0x0000000000000000-mapping.dmp
-
memory/1672-137-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1672-139-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1672-141-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1672-142-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2548-133-0x0000000000000000-mapping.dmp
-
memory/2548-136-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2548-138-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2548-140-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2548-143-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4992-132-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4992-135-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB