442b476c74e3a5146801f93fde02998765760eabfcd60b8be4e56a17ed1fccd6

Analysis

max time kernel
150s
max time network
167s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:14

Target

Carbanak_0AD6DA9E62A2C985156A9C53F8494171.exe
Size

208KB
MD5

0ad6da9e62a2c985156a9c53f8494171
SHA1

b7a10b4cef1ab3ad577490262d222a723c3f540b
SHA256

442b476c74e3a5146801f93fde02998765760eabfcd60b8be4e56a17ed1fccd6
SHA512

9b884e8cbd71a0d3aefc8f64f3cedd5a14a387e36572b36efa8cc09f981ab5e058e40f003498071cfd894706b5143f3135e4aab645c91e7a99fbc79aa5da0e1b
SSDEEP

3072:rBf7/+R33qdyUHlFKsM5XMEfst13JCxvxW4bky:rBiR3IyUFsMLXZsvk4

Score

5^/10

Drops file in System32 directory 2 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Windows\SysWOW64\com\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\com\svchost.exe	svchost.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

Carbanak_0AD6DA9E62A2C985156A9C53F8494171.exesvchost.exe

description	pid	process	target process
PID 1952 set thread context of 1284	1952	Carbanak_0AD6DA9E62A2C985156A9C53F8494171.exe	svchost.exe
PID 1284 set thread context of 1336	1284	svchost.exe	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Carbanak_0AD6DA9E62A2C985156A9C53F8494171.exesvchost.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Carbanak_0AD6DA9E62A2C985156A9C53F8494171.exesvchost.exe

pid process

1952 Carbanak_0AD6DA9E62A2C985156A9C53F8494171.exe
1284 svchost.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

Carbanak_0AD6DA9E62A2C985156A9C53F8494171.exesvchost.exe

description	pid	process	target process
PID 1952 wrote to memory of 1284	1952	Carbanak_0AD6DA9E62A2C985156A9C53F8494171.exe	svchost.exe
PID 1952 wrote to memory of 1284	1952	Carbanak_0AD6DA9E62A2C985156A9C53F8494171.exe	svchost.exe
PID 1952 wrote to memory of 1284	1952	Carbanak_0AD6DA9E62A2C985156A9C53F8494171.exe	svchost.exe
PID 1952 wrote to memory of 1284	1952	Carbanak_0AD6DA9E62A2C985156A9C53F8494171.exe	svchost.exe
PID 1952 wrote to memory of 1284	1952	Carbanak_0AD6DA9E62A2C985156A9C53F8494171.exe	svchost.exe
PID 1284 wrote to memory of 1336	1284	svchost.exe	svchost.exe
PID 1284 wrote to memory of 1336	1284	svchost.exe	svchost.exe
PID 1284 wrote to memory of 1336	1284	svchost.exe	svchost.exe
PID 1284 wrote to memory of 1336	1284	svchost.exe	svchost.exe
PID 1284 wrote to memory of 1336	1284	svchost.exe	svchost.exe

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
3⤵
PID:1336

memory/1284-56-0x00000000000C104B-mapping.dmp

Download
memory/1284-55-0x00000000000C0000-0x00000000000F4000-memory.dmp

Filesize
208KB

Download
memory/1284-58-0x00000000000C0000-0x00000000000F4000-memory.dmp

Filesize
208KB

Download
memory/1284-62-0x00000000000C0000-0x00000000000F4000-memory.dmp

Filesize
208KB

Download
memory/1336-59-0x0000000000080000-0x00000000000B4000-memory.dmp

Filesize
208KB

Download
memory/1336-60-0x000000000008BE4F-mapping.dmp

Download
memory/1336-61-0x0000000000080000-0x00000000000B4000-memory.dmp

Filesize
208KB

Download
memory/1336-63-0x0000000000080000-0x00000000000B4000-memory.dmp

Filesize
208KB

Download
memory/1952-54-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download