Analysis
-
max time kernel
150s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 12:14
Static task
static1
Behavioral task
behavioral1
Sample
746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exe
Resource
win10v2004-20221111-en
General
-
Target
746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exe
-
Size
1.3MB
-
MD5
1db1a0b9ceeeab286c67eab30b29a29f
-
SHA1
545f07efd5ea1ac7ece00f3306abe1850494ad6d
-
SHA256
746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63
-
SHA512
7fb71c6c39f294fa843fec210f5282e318bf951836286c2af6761ec30f1c1e79e97873b8ec235ff857e5ace6d336684cc336ec677b7f1f2643443893a13506b1
-
SSDEEP
24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak:zrKo4ZwCOnYjVmJPa
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exedescription pid process target process PID 384 set thread context of 372 384 746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exe 746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exepid process 372 746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exe 372 746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exe 372 746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exe 372 746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exe 372 746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exedescription pid process target process PID 384 wrote to memory of 372 384 746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exe 746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exe PID 384 wrote to memory of 372 384 746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exe 746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exe PID 384 wrote to memory of 372 384 746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exe 746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exe PID 384 wrote to memory of 372 384 746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exe 746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exe PID 384 wrote to memory of 372 384 746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exe 746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exe PID 384 wrote to memory of 372 384 746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exe 746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exe PID 384 wrote to memory of 372 384 746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exe 746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exe PID 384 wrote to memory of 372 384 746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exe 746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exe PID 384 wrote to memory of 372 384 746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exe 746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exe PID 384 wrote to memory of 372 384 746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exe 746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exe"C:\Users\Admin\AppData\Local\Temp\746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\746274d7970470f9e052a5a917760f1e8fc236d0a92959b1ae29be2bd2f3ba63.exe
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/372-132-0x0000000000000000-mapping.dmp
-
memory/372-133-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/372-134-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/372-135-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/372-136-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/372-137-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB