Analysis
-
max time kernel
206s -
max time network
210s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 13:43
Static task
static1
Behavioral task
behavioral1
Sample
3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exe
Resource
win10v2004-20221111-en
General
-
Target
3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exe
-
Size
1.3MB
-
MD5
9ced80bfeec0b22f6c09e0105a41d03f
-
SHA1
0c6bacc980662b40dd1227596072b37ff688f62b
-
SHA256
3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43
-
SHA512
e095360e5bcb0e1af224900e4c06430bc5a90e47f14cd047d1869f1d3b3a05249147dac2636441e9f2a90fea741eda827d762abd791f3e1ec63be93cb735bc2e
-
SSDEEP
24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak5:zrKo4ZwCOnYjVmJPaG
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exedescription pid process target process PID 2488 set thread context of 1428 2488 3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exe 3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exepid process 1428 3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exe 1428 3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exe 1428 3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exe 1428 3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exe 1428 3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exedescription pid process target process PID 2488 wrote to memory of 1428 2488 3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exe 3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exe PID 2488 wrote to memory of 1428 2488 3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exe 3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exe PID 2488 wrote to memory of 1428 2488 3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exe 3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exe PID 2488 wrote to memory of 1428 2488 3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exe 3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exe PID 2488 wrote to memory of 1428 2488 3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exe 3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exe PID 2488 wrote to memory of 1428 2488 3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exe 3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exe PID 2488 wrote to memory of 1428 2488 3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exe 3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exe PID 2488 wrote to memory of 1428 2488 3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exe 3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exe PID 2488 wrote to memory of 1428 2488 3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exe 3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exe PID 2488 wrote to memory of 1428 2488 3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exe 3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exe"C:\Users\Admin\AppData\Local\Temp\3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3cf1740693e64367265280c01abcc34b47b2219e0a489d5e619fe8ae63a80b43.exe
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1428-132-0x0000000000000000-mapping.dmp
-
memory/1428-133-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/1428-134-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/1428-135-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/1428-136-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/1428-137-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/1428-138-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB