1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1

Analysis

max time kernel
271s
max time network
336s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1.exe
Size

1.3MB
MD5

f4a9a005946fda778688e01499127075
SHA1

7fa87befc77b1c2ce5a2b9e41685f0c1a95c3cb2
SHA256

1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1
SHA512

ba6403e0e36b8cea275c7a5a447265635d2842430038b1d283220e5d41c7768286cf5d4986b262f71202be5e344adea08fa2da663bf2a3985c53d48b1ebca617
SSDEEP

24576:HOiZzDXGLFP53UG7bL1HohIE6BvRx0GOb/4+a0q3bhAqtxe9KZ:ui1DWLFP53UGe76x0ZUphdtPZ

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1.exe

description	pid	process	target process
PID 4976 set thread context of 2676	4976	1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1.exe	1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1.exe

pid	process
2676	1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1.exe
2676	1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1.exe
2676	1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1.exe
2676	1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1.exe
2676	1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1.exe

description	pid	process	target process
PID 4976 wrote to memory of 2676	4976	1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1.exe	1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1.exe
PID 4976 wrote to memory of 2676	4976	1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1.exe	1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1.exe
PID 4976 wrote to memory of 2676	4976	1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1.exe	1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1.exe
PID 4976 wrote to memory of 2676	4976	1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1.exe	1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1.exe
PID 4976 wrote to memory of 2676	4976	1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1.exe	1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1.exe
PID 4976 wrote to memory of 2676	4976	1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1.exe	1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1.exe
PID 4976 wrote to memory of 2676	4976	1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1.exe	1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1.exe
PID 4976 wrote to memory of 2676	4976	1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1.exe	1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1.exe
PID 4976 wrote to memory of 2676	4976	1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1.exe	1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1.exe
PID 4976 wrote to memory of 2676	4976	1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1.exe	1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1.exe

C:\Users\Admin\AppData\Local\Temp\1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1.exe
"C:\Users\Admin\AppData\Local\Temp\1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4976

C:\Users\Admin\AppData\Local\Temp\1b80b4f86286464397009c54076b95d392026af632f8f5b104e710b5c3fab7d1.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:2676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2676-132-0x0000000000000000-mapping.dmp

Download
memory/2676-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2676-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2676-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2676-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2676-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download