Analysis
-
max time kernel
26s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 12:13
Static task
static1
Behavioral task
behavioral1
Sample
539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exe
Resource
win10v2004-20220901-en
General
-
Target
539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exe
-
Size
518KB
-
MD5
7afaa41ca4229c793249fd6bdb9bbeb3
-
SHA1
b94ddda570ada634b3b23b0fc4de718b1c62a239
-
SHA256
539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f
-
SHA512
afb5d2cbf91f184074ffbe937d2963765ef60869cd42687ed1a48ed7975c7bf077ef940efb57148ef231fcc9e6cf885cfe0c2daa385c9e58aee05d212c171991
-
SSDEEP
6144:Rl9RPu5Lmvbo4WMJH6g7q/W9EogLOHrwJUlw75G9+lLPX9MM8e459KOoWqe6w58z:XP+6jo4qe02V6KwYYlLPt5oKnWq35b
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exedescription pid process target process PID 976 wrote to memory of 1144 976 539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exe 539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exe PID 976 wrote to memory of 1144 976 539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exe 539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exe PID 976 wrote to memory of 1144 976 539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exe 539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exe PID 976 wrote to memory of 1144 976 539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exe 539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exe PID 976 wrote to memory of 1144 976 539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exe 539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exe PID 976 wrote to memory of 1144 976 539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exe 539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exe PID 976 wrote to memory of 1144 976 539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exe 539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exe PID 976 wrote to memory of 1504 976 539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exe 539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exe PID 976 wrote to memory of 1504 976 539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exe 539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exe PID 976 wrote to memory of 1504 976 539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exe 539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exe PID 976 wrote to memory of 1504 976 539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exe 539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exe PID 976 wrote to memory of 1504 976 539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exe 539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exe PID 976 wrote to memory of 1504 976 539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exe 539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exe PID 976 wrote to memory of 1504 976 539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exe 539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exe"C:\Users\Admin\AppData\Local\Temp\539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exestart2⤵
-
C:\Users\Admin\AppData\Local\Temp\539e2cf9922feb36d341dc531d6b8f979ab18b16ebaf4c2579c2f1f169dc8d8f.exewatch2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/976-54-0x0000000074C91000-0x0000000074C93000-memory.dmpFilesize
8KB
-
memory/976-57-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1144-56-0x0000000000000000-mapping.dmp
-
memory/1144-60-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1144-62-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1504-55-0x0000000000000000-mapping.dmp
-
memory/1504-61-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1504-63-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB