28b8119d5ce72ac1d3063490fcb5b95ff96bbdb1febf07b1ec972c94247def20

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28b8119d5ce72ac1d3063490fcb5b95ff96bbdb1febf07b1ec972c94247def20.exe
Size

196KB
MD5

270b5ebfffd9d3effe15dbf441f24748
SHA1

a8890c877da09ca3ebcd6e058c09b1dd69f39a9c
SHA256

28b8119d5ce72ac1d3063490fcb5b95ff96bbdb1febf07b1ec972c94247def20
SHA512

7c6f1769fb6fcb59c1726a83ada5643f6710450e4bc57f1c91e80c24933ad92cc3c7f407ba01ba556a8291ed0529234b847030db3a992f0c30e4cf63183396c2
SSDEEP

1536:0qEAKmzOqhSYqs+8u2LY/048mnU9aa91bSkKZhb6FaIPpUgl:3Lca+56U041nU8M1QIaIP2K

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1712 set thread context of 1312	1712	28b8119d5ce72ac1d3063490fcb5b95ff96bbdb1febf07b1ec972c94247def20.exe	27
PID 1712 set thread context of 0	1712	28b8119d5ce72ac1d3063490fcb5b95ff96bbdb1febf07b1ec972c94247def20.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1312	28b8119d5ce72ac1d3063490fcb5b95ff96bbdb1febf07b1ec972c94247def20.exe
1312	28b8119d5ce72ac1d3063490fcb5b95ff96bbdb1febf07b1ec972c94247def20.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1712	28b8119d5ce72ac1d3063490fcb5b95ff96bbdb1febf07b1ec972c94247def20.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1312	1712	28b8119d5ce72ac1d3063490fcb5b95ff96bbdb1febf07b1ec972c94247def20.exe	27
PID 1712 wrote to memory of 1312	1712	28b8119d5ce72ac1d3063490fcb5b95ff96bbdb1febf07b1ec972c94247def20.exe	27
PID 1712 wrote to memory of 1312	1712	28b8119d5ce72ac1d3063490fcb5b95ff96bbdb1febf07b1ec972c94247def20.exe	27
PID 1712 wrote to memory of 1312	1712	28b8119d5ce72ac1d3063490fcb5b95ff96bbdb1febf07b1ec972c94247def20.exe	27
PID 1712 wrote to memory of 1312	1712	28b8119d5ce72ac1d3063490fcb5b95ff96bbdb1febf07b1ec972c94247def20.exe	27
PID 1712 wrote to memory of 1312	1712	28b8119d5ce72ac1d3063490fcb5b95ff96bbdb1febf07b1ec972c94247def20.exe	27
PID 1712 wrote to memory of 1312	1712	28b8119d5ce72ac1d3063490fcb5b95ff96bbdb1febf07b1ec972c94247def20.exe	27
PID 1712 wrote to memory of 1312	1712	28b8119d5ce72ac1d3063490fcb5b95ff96bbdb1febf07b1ec972c94247def20.exe	27
PID 1712 wrote to memory of 0	1712	28b8119d5ce72ac1d3063490fcb5b95ff96bbdb1febf07b1ec972c94247def20.exe
PID 1712 wrote to memory of 0	1712	28b8119d5ce72ac1d3063490fcb5b95ff96bbdb1febf07b1ec972c94247def20.exe
PID 1712 wrote to memory of 0	1712	28b8119d5ce72ac1d3063490fcb5b95ff96bbdb1febf07b1ec972c94247def20.exe
PID 1712 wrote to memory of 0	1712	28b8119d5ce72ac1d3063490fcb5b95ff96bbdb1febf07b1ec972c94247def20.exe
PID 1312 wrote to memory of 1224	1312	28b8119d5ce72ac1d3063490fcb5b95ff96bbdb1febf07b1ec972c94247def20.exe	13
PID 1312 wrote to memory of 1224	1312	28b8119d5ce72ac1d3063490fcb5b95ff96bbdb1febf07b1ec972c94247def20.exe	13
PID 1312 wrote to memory of 1224	1312	28b8119d5ce72ac1d3063490fcb5b95ff96bbdb1febf07b1ec972c94247def20.exe	13
PID 1312 wrote to memory of 1224	1312	28b8119d5ce72ac1d3063490fcb5b95ff96bbdb1febf07b1ec972c94247def20.exe	13

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1224
- C:\Users\Admin\AppData\Local\Temp\28b8119d5ce72ac1d3063490fcb5b95ff96bbdb1febf07b1ec972c94247def20.exe
  "C:\Users\Admin\AppData\Local\Temp\28b8119d5ce72ac1d3063490fcb5b95ff96bbdb1febf07b1ec972c94247def20.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Users\Admin\AppData\Local\Temp\28b8119d5ce72ac1d3063490fcb5b95ff96bbdb1febf07b1ec972c94247def20.exe
    "C:\Users\Admin\AppData\Local\Temp\28b8119d5ce72ac1d3063490fcb5b95ff96bbdb1febf07b1ec972c94247def20.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1224-62-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1312-57-0x0000000000407C89-mapping.dmp

Download
memory/1312-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1312-60-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1312-61-0x00000000765B1000-0x00000000765B3000-memory.dmp

Filesize
8KB

Download
memory/1312-65-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download