Analysis
-
max time kernel
91s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 13:39
Static task
static1
Behavioral task
behavioral1
Sample
3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exe
Resource
win10v2004-20220901-en
General
-
Target
3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exe
-
Size
1.3MB
-
MD5
a1cf9601175cdd58e99fd60d8a1079e4
-
SHA1
98ec6b384f4911ec1f5785a1812b8eefb4f85568
-
SHA256
3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e
-
SHA512
e1909e68a74d600000102175170bbd0fadf29b2cfa74f01911eda7da0f7261014cf9dfaf5a6d7b755abb8fb9c02e14953e9b904d8d37cc5626a1ad7f8e2d4b12
-
SSDEEP
24576:DrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakV:DrKo4ZwCOnYjVmJPa6
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exedescription pid process target process PID 3488 set thread context of 2216 3488 3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exe 3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exepid process 2216 3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exe 2216 3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exe 2216 3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exe 2216 3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exe 2216 3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exedescription pid process target process PID 3488 wrote to memory of 2216 3488 3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exe 3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exe PID 3488 wrote to memory of 2216 3488 3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exe 3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exe PID 3488 wrote to memory of 2216 3488 3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exe 3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exe PID 3488 wrote to memory of 2216 3488 3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exe 3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exe PID 3488 wrote to memory of 2216 3488 3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exe 3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exe PID 3488 wrote to memory of 2216 3488 3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exe 3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exe PID 3488 wrote to memory of 2216 3488 3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exe 3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exe PID 3488 wrote to memory of 2216 3488 3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exe 3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exe PID 3488 wrote to memory of 2216 3488 3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exe 3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exe PID 3488 wrote to memory of 2216 3488 3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exe 3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exe"C:\Users\Admin\AppData\Local\Temp\3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3f7ffbe61f970fa1cca98b269f34aaf76f45ec9d978b287559568d595761c74e.exe
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2216-132-0x0000000000000000-mapping.dmp
-
memory/2216-134-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/2216-135-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/2216-133-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/2216-136-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/2216-137-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB