Analysis
-
max time kernel
153s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 14:44
Static task
static1
Behavioral task
behavioral1
Sample
15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exe
Resource
win10v2004-20220812-en
General
-
Target
15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exe
-
Size
1.6MB
-
MD5
bb4990f04124894abcf1fad9e4f743de
-
SHA1
f2e518e47f1c1be64da54f166bbb7c8d96c36ff8
-
SHA256
15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75
-
SHA512
a52e2ce998390fadc66a2331296bb60f07cff75d31ec07ce8d0f31676b826df3c9cdaeaaebe472cc899dca66ca849e1d17b95a374065a8b32f65c0db7d5ef065
-
SSDEEP
24576:9zD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUYo:X6/ye0PIphrp9Zuvjqa0UidP
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exedescription pid process target process PID 5096 set thread context of 4860 5096 15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exe 15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exepid process 4860 15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exe 4860 15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exe 4860 15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exe 4860 15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exe 4860 15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exedescription pid process target process PID 5096 wrote to memory of 4860 5096 15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exe 15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exe PID 5096 wrote to memory of 4860 5096 15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exe 15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exe PID 5096 wrote to memory of 4860 5096 15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exe 15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exe PID 5096 wrote to memory of 4860 5096 15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exe 15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exe PID 5096 wrote to memory of 4860 5096 15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exe 15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exe PID 5096 wrote to memory of 4860 5096 15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exe 15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exe PID 5096 wrote to memory of 4860 5096 15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exe 15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exe PID 5096 wrote to memory of 4860 5096 15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exe 15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exe PID 5096 wrote to memory of 4860 5096 15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exe 15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exe PID 5096 wrote to memory of 4860 5096 15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exe 15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exe"C:\Users\Admin\AppData\Local\Temp\15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exe"C:\Users\Admin\AppData\Local\Temp\15eee966715870d2eb89c725b5dcb7ad93dcb7c2d2af4c47e4e1cf94a2937b75.exe"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4860-132-0x0000000000000000-mapping.dmp
-
memory/4860-133-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/4860-134-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/4860-135-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/4860-136-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/4860-137-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB