Analysis
-
max time kernel
42s -
max time network
91s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 12:18
Static task
static1
Behavioral task
behavioral1
Sample
31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exe
Resource
win10v2004-20220812-en
General
-
Target
31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exe
-
Size
518KB
-
MD5
c0f2d8f575cc1128799df81f67d12935
-
SHA1
d78d033dc3d90b9b5daa4c3fac8dd15de9ca94bd
-
SHA256
31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776
-
SHA512
d37290894d518a59738bbfde3754a41df595998d13e4ecef01606c204bce1ec6bb33c46ba9bba910c85a664048d240c5ab9c1ddf2ad0342a1b2f66df8ef46e78
-
SSDEEP
12288:6o2fHBk7J7n/3WdQtmDrVwYYlLPt5oKnWq3tb:uk7Jb/3WdQQrSlLPt5/Wg
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exedescription pid process target process PID 956 wrote to memory of 596 956 31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exe 31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exe PID 956 wrote to memory of 596 956 31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exe 31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exe PID 956 wrote to memory of 596 956 31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exe 31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exe PID 956 wrote to memory of 596 956 31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exe 31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exe PID 956 wrote to memory of 596 956 31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exe 31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exe PID 956 wrote to memory of 596 956 31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exe 31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exe PID 956 wrote to memory of 596 956 31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exe 31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exe PID 956 wrote to memory of 280 956 31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exe 31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exe PID 956 wrote to memory of 280 956 31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exe 31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exe PID 956 wrote to memory of 280 956 31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exe 31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exe PID 956 wrote to memory of 280 956 31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exe 31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exe PID 956 wrote to memory of 280 956 31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exe 31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exe PID 956 wrote to memory of 280 956 31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exe 31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exe PID 956 wrote to memory of 280 956 31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exe 31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exe"C:\Users\Admin\AppData\Local\Temp\31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exestart2⤵
-
C:\Users\Admin\AppData\Local\Temp\31aafa4b2cf3c0807283f1d2aabb23a82361231a6cf7e45aa1a0ce4739565776.exewatch2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/280-55-0x0000000000000000-mapping.dmp
-
memory/280-58-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/280-62-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/280-64-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/596-56-0x0000000000000000-mapping.dmp
-
memory/596-61-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/596-63-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/956-54-0x0000000075701000-0x0000000075703000-memory.dmpFilesize
8KB
-
memory/956-57-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB