bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8

Analysis

max time kernel
173s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 00:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8.exe
Size

1.3MB
MD5

d9b2c9f6503734b051658d1261360335
SHA1

078d2e6d1f97a7bff91faeb9bf96354ea2e834ea
SHA256

bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8
SHA512

c994a41f6b660ce5923a51c505599bbd021ebb3dc3f4e044c10392324ae6e9dd93634f8724ec255dd236305cc3ca749f55ba5f593fc1c807c951df8efd07fc00
SSDEEP

24576:WKyKz4D4ufmwhzA2QoPKCys7JdpmnMlxy9KR8uQcuN:WKVzMNuwIKyoBmnMSURNQt

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8.exe

description	pid	process	target process
PID 4508 set thread context of 4988	4508	bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8.exe	bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8.exe

pid	process
4988	bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8.exe
4988	bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8.exe
4988	bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8.exe
4988	bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8.exe
4988	bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8.exe

description	pid	process	target process
PID 4508 wrote to memory of 4988	4508	bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8.exe	bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8.exe
PID 4508 wrote to memory of 4988	4508	bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8.exe	bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8.exe
PID 4508 wrote to memory of 4988	4508	bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8.exe	bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8.exe
PID 4508 wrote to memory of 4988	4508	bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8.exe	bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8.exe
PID 4508 wrote to memory of 4988	4508	bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8.exe	bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8.exe
PID 4508 wrote to memory of 4988	4508	bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8.exe	bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8.exe
PID 4508 wrote to memory of 4988	4508	bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8.exe	bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8.exe
PID 4508 wrote to memory of 4988	4508	bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8.exe	bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8.exe
PID 4508 wrote to memory of 4988	4508	bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8.exe	bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8.exe
PID 4508 wrote to memory of 4988	4508	bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8.exe	bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8.exe

C:\Users\Admin\AppData\Local\Temp\bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8.exe
"C:\Users\Admin\AppData\Local\Temp\bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4508

C:\Users\Admin\AppData\Local\Temp\bc1e25164f6343887deacebe28e6412a52e81e542f23c04e0558af04ba2cacc8.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4988-132-0x0000000000000000-mapping.dmp

Download
memory/4988-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4988-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4988-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4988-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4988-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download