159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c

Analysis

max time kernel
320s
max time network
385s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c.exe
Size

1.3MB
MD5

8e9938f9f77446bcef4997c677d082ec
SHA1

4c4372be6ddb795295bc70f10f3da9eeced2ace9
SHA256

159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c
SHA512

5bbaa6278ba029b63b578b3e0796d467cf519cb8682936029049d9e6e1f3095d81ea23c8439a5beba13d090fc9741968946c3d3edc3eb19fe67395ea461b9b8b
SSDEEP

24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakg:TrKo4ZwCOnYjVmJPa/

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c.exe

description	pid	process	target process
PID 2496 set thread context of 5092	2496	159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c.exe	159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c.exe

pid	process
5092	159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c.exe
5092	159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c.exe
5092	159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c.exe
5092	159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c.exe
5092	159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c.exe

description	pid	process	target process
PID 2496 wrote to memory of 5092	2496	159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c.exe	159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c.exe
PID 2496 wrote to memory of 5092	2496	159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c.exe	159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c.exe
PID 2496 wrote to memory of 5092	2496	159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c.exe	159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c.exe
PID 2496 wrote to memory of 5092	2496	159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c.exe	159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c.exe
PID 2496 wrote to memory of 5092	2496	159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c.exe	159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c.exe
PID 2496 wrote to memory of 5092	2496	159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c.exe	159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c.exe
PID 2496 wrote to memory of 5092	2496	159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c.exe	159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c.exe
PID 2496 wrote to memory of 5092	2496	159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c.exe	159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c.exe
PID 2496 wrote to memory of 5092	2496	159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c.exe	159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c.exe
PID 2496 wrote to memory of 5092	2496	159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c.exe	159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c.exe

C:\Users\Admin\AppData\Local\Temp\159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c.exe
"C:\Users\Admin\AppData\Local\Temp\159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2496

C:\Users\Admin\AppData\Local\Temp\159bb2e01850948eb7564bc571ba49a799e51206fd0d0f3bb5e73caa1c97a04c.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:5092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5092-132-0x0000000000000000-mapping.dmp

Download
memory/5092-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/5092-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/5092-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/5092-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/5092-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download