d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47

Analysis

max time kernel
142s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 04:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe
Size

108KB
MD5

e3bc87061d51fa234a9bcd020bbe19d6
SHA1

5e8c17ab5fc5dd554c4f0a227fd667dd1c9d3f2a
SHA256

d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47
SHA512

2e08bbcf52f1ef91bb48b8f216e9ae8013c0a4447f0696d5aa147e3a4dbbbbb0b57b47b65c16866f150faf3472a27a30b959aff0c121919234437a0a5322b418
SSDEEP

1536:qlVFlaRehGwmjYeDWe5T62ny1k/jN6pTSedYlmdltlNl5qc2PUvRnJFgW0yR:0PavnxDd5e2ny1c8gNcjJFl0

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe

description	pid	process	target process
PID 2204 set thread context of 4336	2204	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe

pid	process
4336	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe
4336	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe
4336	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe
4336	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe
4336	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe
4336	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe

pid process

2204 d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe

pid	process
2204	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe

description	pid	process	target process
PID 2204 wrote to memory of 4336	2204	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe
PID 2204 wrote to memory of 4336	2204	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe
PID 2204 wrote to memory of 4336	2204	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe
PID 2204 wrote to memory of 4336	2204	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe
PID 2204 wrote to memory of 4336	2204	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe
PID 2204 wrote to memory of 4336	2204	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe
PID 2204 wrote to memory of 4336	2204	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe
PID 2204 wrote to memory of 4336	2204	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe	d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe

C:\Users\Admin\AppData\Local\Temp\d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe
"C:\Users\Admin\AppData\Local\Temp\d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204

C:\Users\Admin\AppData\Local\Temp\d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe
"C:\Users\Admin\AppData\Local\Temp\d6b33c683d5866a70accd0e3fa75e6cd6a112c2d581b3bbee6889307e6638e47.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:4336

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4336-134-0x0000000000000000-mapping.dmp

Download
memory/4336-135-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4336-137-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4336-138-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/4336-142-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4336-143-0x0000000000402000-0x0000000000403000-memory.dmp

Filesize
4KB

Download
memory/4336-144-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download