Analysis
-
max time kernel
151s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 13:34
Static task
static1
Behavioral task
behavioral1
Sample
42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exe
Resource
win10v2004-20221111-en
General
-
Target
42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exe
-
Size
1.3MB
-
MD5
f76315932d2ec8d7dd314633434760d5
-
SHA1
fcb1aa95d56f3ec1789d620b9ef06ba0380d5f92
-
SHA256
42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298
-
SHA512
f71c71fc596f276303d6d8d4c4c6c6141df40d340af1a75cef5cde0f1a935abc2215794333eb18a9ffe1e6c5d4f3f7bad2a3d0adaadb97141de76fa2136a77bd
-
SSDEEP
24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakM:zrKo4ZwCOnYjVmJPaT
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exedescription pid process target process PID 1120 set thread context of 3424 1120 42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exe 42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exepid process 3424 42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exe 3424 42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exe 3424 42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exe 3424 42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exe 3424 42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exedescription pid process target process PID 1120 wrote to memory of 3424 1120 42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exe 42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exe PID 1120 wrote to memory of 3424 1120 42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exe 42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exe PID 1120 wrote to memory of 3424 1120 42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exe 42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exe PID 1120 wrote to memory of 3424 1120 42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exe 42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exe PID 1120 wrote to memory of 3424 1120 42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exe 42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exe PID 1120 wrote to memory of 3424 1120 42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exe 42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exe PID 1120 wrote to memory of 3424 1120 42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exe 42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exe PID 1120 wrote to memory of 3424 1120 42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exe 42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exe PID 1120 wrote to memory of 3424 1120 42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exe 42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exe PID 1120 wrote to memory of 3424 1120 42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exe 42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exe"C:\Users\Admin\AppData\Local\Temp\42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\42df3e440fce7d1e2b294a6d8b23204bdca645abd7f7d61703eeb1afcf807298.exe
- Suspicious use of SetWindowsHookEx
PID:3424
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3424-132-0x0000000000000000-mapping.dmp
-
memory/3424-133-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/3424-134-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/3424-135-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/3424-136-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/3424-137-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/3424-138-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB