Analysis
-
max time kernel
95s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 12:20
Static task
static1
Behavioral task
behavioral1
Sample
26a570fff02845fea0ce8dd3dce83d95c2d284baa09515a6715736fc02a144f3.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
26a570fff02845fea0ce8dd3dce83d95c2d284baa09515a6715736fc02a144f3.exe
Resource
win10v2004-20220901-en
General
-
Target
26a570fff02845fea0ce8dd3dce83d95c2d284baa09515a6715736fc02a144f3.exe
-
Size
522KB
-
MD5
19f17f02dcf82e6363f01c30d31cccdb
-
SHA1
66e1dd597cad2b241f0219c8558ed5a5671590a3
-
SHA256
26a570fff02845fea0ce8dd3dce83d95c2d284baa09515a6715736fc02a144f3
-
SHA512
62a17efe2bcdb42ca0078a01cd969a1264c9023874565cdb97f1867e832cb5bdf7aa46138f0c6602493f955615391a03fc57f54cf40ad0db5191e58ef8c6564a
-
SSDEEP
12288:NxVoVQ8l0gLDnapy3rpIwYYlLPt5oKnWq39bQ:zVVE0Onapkp5lLPt5/W4Q
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
26a570fff02845fea0ce8dd3dce83d95c2d284baa09515a6715736fc02a144f3.exedescription pid process target process PID 4060 wrote to memory of 5044 4060 26a570fff02845fea0ce8dd3dce83d95c2d284baa09515a6715736fc02a144f3.exe 26a570fff02845fea0ce8dd3dce83d95c2d284baa09515a6715736fc02a144f3.exe PID 4060 wrote to memory of 5044 4060 26a570fff02845fea0ce8dd3dce83d95c2d284baa09515a6715736fc02a144f3.exe 26a570fff02845fea0ce8dd3dce83d95c2d284baa09515a6715736fc02a144f3.exe PID 4060 wrote to memory of 5044 4060 26a570fff02845fea0ce8dd3dce83d95c2d284baa09515a6715736fc02a144f3.exe 26a570fff02845fea0ce8dd3dce83d95c2d284baa09515a6715736fc02a144f3.exe PID 4060 wrote to memory of 4920 4060 26a570fff02845fea0ce8dd3dce83d95c2d284baa09515a6715736fc02a144f3.exe 26a570fff02845fea0ce8dd3dce83d95c2d284baa09515a6715736fc02a144f3.exe PID 4060 wrote to memory of 4920 4060 26a570fff02845fea0ce8dd3dce83d95c2d284baa09515a6715736fc02a144f3.exe 26a570fff02845fea0ce8dd3dce83d95c2d284baa09515a6715736fc02a144f3.exe PID 4060 wrote to memory of 4920 4060 26a570fff02845fea0ce8dd3dce83d95c2d284baa09515a6715736fc02a144f3.exe 26a570fff02845fea0ce8dd3dce83d95c2d284baa09515a6715736fc02a144f3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\26a570fff02845fea0ce8dd3dce83d95c2d284baa09515a6715736fc02a144f3.exe"C:\Users\Admin\AppData\Local\Temp\26a570fff02845fea0ce8dd3dce83d95c2d284baa09515a6715736fc02a144f3.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\26a570fff02845fea0ce8dd3dce83d95c2d284baa09515a6715736fc02a144f3.exestart2⤵
-
C:\Users\Admin\AppData\Local\Temp\26a570fff02845fea0ce8dd3dce83d95c2d284baa09515a6715736fc02a144f3.exewatch2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4060-132-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/4060-135-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/4920-133-0x0000000000000000-mapping.dmp
-
memory/4920-136-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/4920-138-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/4920-140-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/5044-134-0x0000000000000000-mapping.dmp
-
memory/5044-137-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/5044-139-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB