9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd

Analysis

max time kernel
206s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 00:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd.exe
Size

1.3MB
MD5

ba82e459960c97d4c7d383c4b5e642a2
SHA1

1abf503aa3af8874787a56f4703b8e718787643b
SHA256

9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd
SHA512

c217ca765fd8d8ec0b4f26fa80af55c76558a9a1f4415d4f43e2082fbca1ae05e37200a1f09be6ce8485248cd11ebb978de73433e8a0941fd2ccb5c3249380c7
SSDEEP

24576:vKyKz4D4ufmwhzA2QoPKCys7JdpmnMlxy9KR8uQcuD:vKVzMNuwIKyoBmnMSURNQj

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd.exe

description	pid	process	target process
PID 4524 set thread context of 4256	4524	9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd.exe	9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd.exe

pid	process
4256	9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd.exe
4256	9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd.exe
4256	9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd.exe
4256	9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd.exe
4256	9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd.exe

description	pid	process	target process
PID 4524 wrote to memory of 4256	4524	9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd.exe	9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd.exe
PID 4524 wrote to memory of 4256	4524	9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd.exe	9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd.exe
PID 4524 wrote to memory of 4256	4524	9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd.exe	9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd.exe
PID 4524 wrote to memory of 4256	4524	9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd.exe	9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd.exe
PID 4524 wrote to memory of 4256	4524	9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd.exe	9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd.exe
PID 4524 wrote to memory of 4256	4524	9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd.exe	9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd.exe
PID 4524 wrote to memory of 4256	4524	9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd.exe	9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd.exe
PID 4524 wrote to memory of 4256	4524	9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd.exe	9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd.exe
PID 4524 wrote to memory of 4256	4524	9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd.exe	9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd.exe
PID 4524 wrote to memory of 4256	4524	9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd.exe	9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd.exe

C:\Users\Admin\AppData\Local\Temp\9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd.exe
"C:\Users\Admin\AppData\Local\Temp\9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4524

C:\Users\Admin\AppData\Local\Temp\9ef6b925532664c279bf63eb2ac654736dd6861a1d582e5c20e0db26556e9cfd.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4256-132-0x0000000000000000-mapping.dmp

Download
memory/4256-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4256-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4256-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4256-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4256-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4256-138-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download