Analysis
-
max time kernel
162s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 14:45
Static task
static1
Behavioral task
behavioral1
Sample
154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exe
Resource
win10v2004-20221111-en
General
-
Target
154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exe
-
Size
1.6MB
-
MD5
eb202892456c94cfc06d154340bc09c4
-
SHA1
8c32e49e07f463abfc1bee02eadc174a7a04dc1b
-
SHA256
154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc
-
SHA512
ffe5268d5e88124454ada8528af2c18de4f29e424a68b7327d7a1cc252531d55e78f34b219e07917326d1e79a67e4cf9e51f7cccfb9266898d7b483359a025b5
-
SSDEEP
24576:NzD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUY8:n6/ye0PIphrp9Zuvjqa0Uidf
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exedescription pid process target process PID 772 set thread context of 4932 772 154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exe 154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exepid process 4932 154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exe 4932 154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exe 4932 154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exe 4932 154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exe 4932 154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exedescription pid process target process PID 772 wrote to memory of 4932 772 154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exe 154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exe PID 772 wrote to memory of 4932 772 154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exe 154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exe PID 772 wrote to memory of 4932 772 154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exe 154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exe PID 772 wrote to memory of 4932 772 154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exe 154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exe PID 772 wrote to memory of 4932 772 154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exe 154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exe PID 772 wrote to memory of 4932 772 154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exe 154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exe PID 772 wrote to memory of 4932 772 154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exe 154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exe PID 772 wrote to memory of 4932 772 154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exe 154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exe PID 772 wrote to memory of 4932 772 154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exe 154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exe PID 772 wrote to memory of 4932 772 154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exe 154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exe"C:\Users\Admin\AppData\Local\Temp\154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exe"C:\Users\Admin\AppData\Local\Temp\154f7ef056da7219c0631762d19f82a4cfc46b28ab0d355b13f15dc370ecc8dc.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:4932