f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a

Analysis

max time kernel
94s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 00:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a.exe
Size

1.3MB
MD5

e4a73a11d37d1b9c489044bbb79d639a
SHA1

691db6ac2febcd1d021ce28dc1b58a92aa3338be
SHA256

f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a
SHA512

6bcd8c6f66c77c091e3a80e1171eed6bfdaf033c0387b92bd67c5178afac5e98700491300d191a90403e2a10938de35f261e1f1bd83e177b63f768b773247d6c
SSDEEP

24576:EpyhP5RFFrSEyFPu8JR9ksaQFCLwbLflBPx:LyFPu8D9k5QELuLJ

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a.exe

description	pid	process	target process
PID 2060 set thread context of 3496	2060	f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a.exe	f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a.exe

pid	process
3496	f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a.exe
3496	f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a.exe
3496	f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a.exe
3496	f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a.exe
3496	f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a.exe

description	pid	process	target process
PID 2060 wrote to memory of 3496	2060	f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a.exe	f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a.exe
PID 2060 wrote to memory of 3496	2060	f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a.exe	f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a.exe
PID 2060 wrote to memory of 3496	2060	f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a.exe	f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a.exe
PID 2060 wrote to memory of 3496	2060	f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a.exe	f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a.exe
PID 2060 wrote to memory of 3496	2060	f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a.exe	f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a.exe
PID 2060 wrote to memory of 3496	2060	f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a.exe	f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a.exe
PID 2060 wrote to memory of 3496	2060	f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a.exe	f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a.exe
PID 2060 wrote to memory of 3496	2060	f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a.exe	f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a.exe
PID 2060 wrote to memory of 3496	2060	f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a.exe	f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a.exe
PID 2060 wrote to memory of 3496	2060	f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a.exe	f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a.exe

C:\Users\Admin\AppData\Local\Temp\f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a.exe
"C:\Users\Admin\AppData\Local\Temp\f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2060

C:\Users\Admin\AppData\Local\Temp\f02e8fe1cc6db249592fbeefeb76c23c97f7b59b216b7fadb38dfb5c5b54d99a.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:3496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3496-132-0x0000000000000000-mapping.dmp

Download
memory/3496-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3496-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3496-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3496-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3496-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3496-138-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download