Analysis
-
max time kernel
90s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 12:39
Static task
static1
Behavioral task
behavioral1
Sample
f924d3bc11f99bf4189579ce6c1bc943a0997e0050402e9fe62aedf3a4264624.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
f924d3bc11f99bf4189579ce6c1bc943a0997e0050402e9fe62aedf3a4264624.exe
Resource
win10v2004-20220901-en
General
-
Target
f924d3bc11f99bf4189579ce6c1bc943a0997e0050402e9fe62aedf3a4264624.exe
-
Size
522KB
-
MD5
9ee189de0c7d99bca7de52e2b3e66068
-
SHA1
6362c2e0be3b3e3b312ec9ca4f37ee24f89147f7
-
SHA256
f924d3bc11f99bf4189579ce6c1bc943a0997e0050402e9fe62aedf3a4264624
-
SHA512
8dc9000fb427bbda5aa85a9429cf8c305c662ec58cda5f8a632f0435967ab199cd45ad43f5fbc95ebad3c5577bbe61696411ebbe48bb6ef9696a6be7fe31547d
-
SSDEEP
12288:o0OcFUedRtEXRR4RGMaYnCDpwtWsjYO9AtwzH://UrhR4ETCrkO9qwb
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
f924d3bc11f99bf4189579ce6c1bc943a0997e0050402e9fe62aedf3a4264624.exedescription pid process target process PID 1992 wrote to memory of 4184 1992 f924d3bc11f99bf4189579ce6c1bc943a0997e0050402e9fe62aedf3a4264624.exe f924d3bc11f99bf4189579ce6c1bc943a0997e0050402e9fe62aedf3a4264624.exe PID 1992 wrote to memory of 4184 1992 f924d3bc11f99bf4189579ce6c1bc943a0997e0050402e9fe62aedf3a4264624.exe f924d3bc11f99bf4189579ce6c1bc943a0997e0050402e9fe62aedf3a4264624.exe PID 1992 wrote to memory of 4184 1992 f924d3bc11f99bf4189579ce6c1bc943a0997e0050402e9fe62aedf3a4264624.exe f924d3bc11f99bf4189579ce6c1bc943a0997e0050402e9fe62aedf3a4264624.exe PID 1992 wrote to memory of 3956 1992 f924d3bc11f99bf4189579ce6c1bc943a0997e0050402e9fe62aedf3a4264624.exe f924d3bc11f99bf4189579ce6c1bc943a0997e0050402e9fe62aedf3a4264624.exe PID 1992 wrote to memory of 3956 1992 f924d3bc11f99bf4189579ce6c1bc943a0997e0050402e9fe62aedf3a4264624.exe f924d3bc11f99bf4189579ce6c1bc943a0997e0050402e9fe62aedf3a4264624.exe PID 1992 wrote to memory of 3956 1992 f924d3bc11f99bf4189579ce6c1bc943a0997e0050402e9fe62aedf3a4264624.exe f924d3bc11f99bf4189579ce6c1bc943a0997e0050402e9fe62aedf3a4264624.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f924d3bc11f99bf4189579ce6c1bc943a0997e0050402e9fe62aedf3a4264624.exe"C:\Users\Admin\AppData\Local\Temp\f924d3bc11f99bf4189579ce6c1bc943a0997e0050402e9fe62aedf3a4264624.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\f924d3bc11f99bf4189579ce6c1bc943a0997e0050402e9fe62aedf3a4264624.exestart2⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\f924d3bc11f99bf4189579ce6c1bc943a0997e0050402e9fe62aedf3a4264624.exewatch2⤵PID:3956
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1992-132-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1992-135-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/3956-133-0x0000000000000000-mapping.dmp
-
memory/3956-137-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/3956-139-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/3956-141-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4184-134-0x0000000000000000-mapping.dmp
-
memory/4184-136-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4184-138-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4184-140-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB