Analysis
-
max time kernel
28s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 19:04
Static task
static1
Behavioral task
behavioral1
Sample
5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exe
Resource
win10v2004-20220812-en
General
-
Target
5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exe
-
Size
188KB
-
MD5
456de3c5ca2245c64ec65492b9bd03f0
-
SHA1
c74609db62cadbb150bd41a55e461e25e435e534
-
SHA256
5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0
-
SHA512
537e29ab224907eb9730884f266a3e07e7692fdcac8db255d7e204aae341fd7171d92806c452502adc4c41351bcba1da39e29ddb2a002bede4b97723d09d3fc7
-
SSDEEP
3072:abrkco+AZw03pClHYNVuzqt3JaOgLhJwYf+HQSuMQz26rMfRp7dpXsVncrz:YodpCWNIqt3Zgtj+HQShQuf7dFMIz
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exedescription pid process target process PID 1932 set thread context of 788 1932 5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exe 5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exepid process 788 5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exe 788 5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exepid process 1932 5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exe5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exedescription pid process target process PID 1932 wrote to memory of 788 1932 5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exe 5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exe PID 1932 wrote to memory of 788 1932 5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exe 5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exe PID 1932 wrote to memory of 788 1932 5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exe 5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exe PID 1932 wrote to memory of 788 1932 5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exe 5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exe PID 1932 wrote to memory of 788 1932 5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exe 5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exe PID 1932 wrote to memory of 788 1932 5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exe 5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exe PID 1932 wrote to memory of 788 1932 5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exe 5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exe PID 1932 wrote to memory of 788 1932 5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exe 5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exe PID 788 wrote to memory of 1244 788 5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exe Explorer.EXE PID 788 wrote to memory of 1244 788 5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exe Explorer.EXE PID 788 wrote to memory of 1244 788 5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exe Explorer.EXE PID 788 wrote to memory of 1244 788 5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exe"C:\Users\Admin\AppData\Local\Temp\5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exeC:\Users\Admin\AppData\Local\Temp\5a816dbdf936910daa304e27d9085b5581ec57dda13209244b23da5a85276ec0.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/788-68-0x0000000000400000-0x0000000000408960-memory.dmpFilesize
34KB
-
memory/788-57-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/788-58-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/788-60-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/788-61-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/788-62-0x0000000000407C89-mapping.dmp
-
memory/788-73-0x0000000010000000-0x0000000010013000-memory.dmpFilesize
76KB
-
memory/788-69-0x0000000076181000-0x0000000076183000-memory.dmpFilesize
8KB
-
memory/1244-70-0x000000007FFF0000-0x000000007FFF7000-memory.dmpFilesize
28KB
-
memory/1932-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1932-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1932-66-0x00000000002E0000-0x0000000000319000-memory.dmpFilesize
228KB
-
memory/1932-65-0x00000000002A0000-0x00000000002A4000-memory.dmpFilesize
16KB
-
memory/1932-54-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1932-74-0x00000000002E0000-0x0000000000319000-memory.dmpFilesize
228KB