Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 12:10
Static task
static1
Behavioral task
behavioral1
Sample
663827af220c673c3c32e4fcab8e0063206b61e7426c89d55d0e6ebe4cfe4b24.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
663827af220c673c3c32e4fcab8e0063206b61e7426c89d55d0e6ebe4cfe4b24.exe
Resource
win10v2004-20220812-en
General
-
Target
663827af220c673c3c32e4fcab8e0063206b61e7426c89d55d0e6ebe4cfe4b24.exe
-
Size
522KB
-
MD5
831ed1cc1b6ae37a03819720860e873d
-
SHA1
bc736c9e377ff8bcb237a4c5b7a7e2ef22f04afe
-
SHA256
663827af220c673c3c32e4fcab8e0063206b61e7426c89d55d0e6ebe4cfe4b24
-
SHA512
03b13322ca24b1ff97f1f44dd32fbc51b117a2ddca3ed31c11788bfb7452b8250eba44f300acdb5333eb47f189ce277a8746af0d1d6bfaf9d8578a773b9f5716
-
SSDEEP
12288:ig6KB9+y3Uax2uUYqOJ45Zy18xQqpx8O5N:igZ9fkRFmJwZatqpx8
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
663827af220c673c3c32e4fcab8e0063206b61e7426c89d55d0e6ebe4cfe4b24.exedescription pid process target process PID 2080 wrote to memory of 452 2080 663827af220c673c3c32e4fcab8e0063206b61e7426c89d55d0e6ebe4cfe4b24.exe 663827af220c673c3c32e4fcab8e0063206b61e7426c89d55d0e6ebe4cfe4b24.exe PID 2080 wrote to memory of 452 2080 663827af220c673c3c32e4fcab8e0063206b61e7426c89d55d0e6ebe4cfe4b24.exe 663827af220c673c3c32e4fcab8e0063206b61e7426c89d55d0e6ebe4cfe4b24.exe PID 2080 wrote to memory of 452 2080 663827af220c673c3c32e4fcab8e0063206b61e7426c89d55d0e6ebe4cfe4b24.exe 663827af220c673c3c32e4fcab8e0063206b61e7426c89d55d0e6ebe4cfe4b24.exe PID 2080 wrote to memory of 3428 2080 663827af220c673c3c32e4fcab8e0063206b61e7426c89d55d0e6ebe4cfe4b24.exe 663827af220c673c3c32e4fcab8e0063206b61e7426c89d55d0e6ebe4cfe4b24.exe PID 2080 wrote to memory of 3428 2080 663827af220c673c3c32e4fcab8e0063206b61e7426c89d55d0e6ebe4cfe4b24.exe 663827af220c673c3c32e4fcab8e0063206b61e7426c89d55d0e6ebe4cfe4b24.exe PID 2080 wrote to memory of 3428 2080 663827af220c673c3c32e4fcab8e0063206b61e7426c89d55d0e6ebe4cfe4b24.exe 663827af220c673c3c32e4fcab8e0063206b61e7426c89d55d0e6ebe4cfe4b24.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\663827af220c673c3c32e4fcab8e0063206b61e7426c89d55d0e6ebe4cfe4b24.exe"C:\Users\Admin\AppData\Local\Temp\663827af220c673c3c32e4fcab8e0063206b61e7426c89d55d0e6ebe4cfe4b24.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\663827af220c673c3c32e4fcab8e0063206b61e7426c89d55d0e6ebe4cfe4b24.exestart2⤵
-
C:\Users\Admin\AppData\Local\Temp\663827af220c673c3c32e4fcab8e0063206b61e7426c89d55d0e6ebe4cfe4b24.exewatch2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/452-134-0x0000000000000000-mapping.dmp
-
memory/452-137-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/452-139-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/452-141-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/452-142-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2080-132-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2080-135-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/3428-133-0x0000000000000000-mapping.dmp
-
memory/3428-136-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/3428-138-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/3428-140-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/3428-143-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB