Analysis
-
max time kernel
160s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 13:38
Static task
static1
Behavioral task
behavioral1
Sample
939b9ba4585d5064f59cf3e153b4297d3392c7791d5d5ad7263ccd4aa3d34140.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
939b9ba4585d5064f59cf3e153b4297d3392c7791d5d5ad7263ccd4aa3d34140.exe
Resource
win10v2004-20220812-en
General
-
Target
939b9ba4585d5064f59cf3e153b4297d3392c7791d5d5ad7263ccd4aa3d34140.exe
-
Size
518KB
-
MD5
11ff7083a8a459c3273dd3ee8b348f13
-
SHA1
923a7b4ffd7249d5d94a32b68e4dcf6ed421649c
-
SHA256
939b9ba4585d5064f59cf3e153b4297d3392c7791d5d5ad7263ccd4aa3d34140
-
SHA512
89e0454c616b8b1fc1f7d2346a162110390dbe52988d55001eb6c52c1df0b47e67a788f019b6c6cc3d5dd74986ba53e2a35fcfbdf6798fc45713104887fb59c0
-
SSDEEP
12288:wmt8C85jabaZwPUjASES/ya+WJPwTOEC/J:wa98lab/PuAsz+OPwTvC/
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
939b9ba4585d5064f59cf3e153b4297d3392c7791d5d5ad7263ccd4aa3d34140.exedescription pid process target process PID 2656 wrote to memory of 3788 2656 939b9ba4585d5064f59cf3e153b4297d3392c7791d5d5ad7263ccd4aa3d34140.exe 939b9ba4585d5064f59cf3e153b4297d3392c7791d5d5ad7263ccd4aa3d34140.exe PID 2656 wrote to memory of 3788 2656 939b9ba4585d5064f59cf3e153b4297d3392c7791d5d5ad7263ccd4aa3d34140.exe 939b9ba4585d5064f59cf3e153b4297d3392c7791d5d5ad7263ccd4aa3d34140.exe PID 2656 wrote to memory of 3788 2656 939b9ba4585d5064f59cf3e153b4297d3392c7791d5d5ad7263ccd4aa3d34140.exe 939b9ba4585d5064f59cf3e153b4297d3392c7791d5d5ad7263ccd4aa3d34140.exe PID 2656 wrote to memory of 2076 2656 939b9ba4585d5064f59cf3e153b4297d3392c7791d5d5ad7263ccd4aa3d34140.exe 939b9ba4585d5064f59cf3e153b4297d3392c7791d5d5ad7263ccd4aa3d34140.exe PID 2656 wrote to memory of 2076 2656 939b9ba4585d5064f59cf3e153b4297d3392c7791d5d5ad7263ccd4aa3d34140.exe 939b9ba4585d5064f59cf3e153b4297d3392c7791d5d5ad7263ccd4aa3d34140.exe PID 2656 wrote to memory of 2076 2656 939b9ba4585d5064f59cf3e153b4297d3392c7791d5d5ad7263ccd4aa3d34140.exe 939b9ba4585d5064f59cf3e153b4297d3392c7791d5d5ad7263ccd4aa3d34140.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\939b9ba4585d5064f59cf3e153b4297d3392c7791d5d5ad7263ccd4aa3d34140.exe"C:\Users\Admin\AppData\Local\Temp\939b9ba4585d5064f59cf3e153b4297d3392c7791d5d5ad7263ccd4aa3d34140.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\939b9ba4585d5064f59cf3e153b4297d3392c7791d5d5ad7263ccd4aa3d34140.exestart2⤵
-
C:\Users\Admin\AppData\Local\Temp\939b9ba4585d5064f59cf3e153b4297d3392c7791d5d5ad7263ccd4aa3d34140.exewatch2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2076-133-0x0000000000000000-mapping.dmp
-
memory/2076-136-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/2076-139-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/2656-132-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/2656-135-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/3788-134-0x0000000000000000-mapping.dmp
-
memory/3788-137-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/3788-138-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB