Analysis
-
max time kernel
188s -
max time network
243s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 00:30
Static task
static1
Behavioral task
behavioral1
Sample
cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exe
Resource
win10v2004-20221111-en
General
-
Target
cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exe
-
Size
1.3MB
-
MD5
f73b8332b0a3568399fc1d4651813456
-
SHA1
dfafee17fb2040606c084c3a37bca35a9d4810f9
-
SHA256
cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d
-
SHA512
d70848d6aae485df5dba62e79290e78a6fe32281928a35097e7ad4e7bba58172a7f10ee2dcde27ff1b1fb31d6a4325b3e19474a1639cd55594be847fe0245472
-
SSDEEP
24576:EpyhP5RFFrSEyFPu8JR9ksaQFCLwbLflBPB:LyFPu8D9k5QELuL5
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exedescription pid process target process PID 3500 set thread context of 3552 3500 cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exe cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exepid process 3552 cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exe 3552 cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exe 3552 cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exe 3552 cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exe 3552 cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exedescription pid process target process PID 3500 wrote to memory of 3552 3500 cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exe cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exe PID 3500 wrote to memory of 3552 3500 cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exe cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exe PID 3500 wrote to memory of 3552 3500 cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exe cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exe PID 3500 wrote to memory of 3552 3500 cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exe cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exe PID 3500 wrote to memory of 3552 3500 cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exe cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exe PID 3500 wrote to memory of 3552 3500 cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exe cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exe PID 3500 wrote to memory of 3552 3500 cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exe cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exe PID 3500 wrote to memory of 3552 3500 cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exe cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exe PID 3500 wrote to memory of 3552 3500 cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exe cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exe PID 3500 wrote to memory of 3552 3500 cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exe cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exe"C:\Users\Admin\AppData\Local\Temp\cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cd5b62e26ee75dc2979246f21afee4e23b65026c60593f6165ffc47dcb2ca03d.exe
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3552-132-0x0000000000000000-mapping.dmp
-
memory/3552-133-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/3552-134-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/3552-135-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/3552-136-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/3552-137-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/3552-138-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB