Analysis
-
max time kernel
259s -
max time network
269s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 07:48
Static task
static1
Behavioral task
behavioral1
Sample
5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe
Resource
win10v2004-20221111-en
General
-
Target
5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe
-
Size
244KB
-
MD5
b725067c7926e8a3268d2fabfcad7b4e
-
SHA1
2518fb688bec920f49e6b20144dc385866a2a70c
-
SHA256
5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef
-
SHA512
41a2631b82f007cfca0e50904ff288995c202583c0da99df94cf840f5f3b8b6cb332e17cd95ce737f4379074e60250932b5c61d39cb37d829003915c538f908c
-
SSDEEP
6144:zKsiUOlPoYuvIPXCJ7/r32Ay1BJWCTVTAmk:zx8QYuOCp2Ay/dK
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
explorer.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d6485ca.exe explorer.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d6485c = "C:\\d6485ca\\d6485ca.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*6485c = "C:\\d6485ca\\d6485ca.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d6485ca = "C:\\Users\\Admin\\AppData\\Roaming\\d6485ca.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*6485ca = "C:\\Users\\Admin\\AppData\\Roaming\\d6485ca.exe" explorer.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exedescription pid process target process PID 1784 set thread context of 4264 1784 5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe 5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exepid process 1784 5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe 1784 5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe 1784 5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe 1784 5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe 1784 5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe 1784 5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exeexplorer.exepid process 4264 5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe 3848 explorer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exepid process 1784 5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe 1784 5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exeexplorer.exedescription pid process target process PID 1784 wrote to memory of 4264 1784 5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe 5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe PID 1784 wrote to memory of 4264 1784 5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe 5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe PID 1784 wrote to memory of 4264 1784 5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe 5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe PID 1784 wrote to memory of 4264 1784 5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe 5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe PID 1784 wrote to memory of 4264 1784 5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe 5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe PID 1784 wrote to memory of 4264 1784 5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe 5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe PID 1784 wrote to memory of 4264 1784 5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe 5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe PID 1784 wrote to memory of 4264 1784 5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe 5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe PID 1784 wrote to memory of 4264 1784 5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe 5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe PID 4264 wrote to memory of 3848 4264 5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe explorer.exe PID 4264 wrote to memory of 3848 4264 5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe explorer.exe PID 4264 wrote to memory of 3848 4264 5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe explorer.exe PID 3848 wrote to memory of 1460 3848 explorer.exe svchost.exe PID 3848 wrote to memory of 1460 3848 explorer.exe svchost.exe PID 3848 wrote to memory of 1460 3848 explorer.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe"C:\Users\Admin\AppData\Local\Temp\5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exeC:\Users\Admin\AppData\Local\Temp\5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\syswow64\explorer.exe"3⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe-k netsvcs4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1460-139-0x0000000000000000-mapping.dmp
-
memory/1460-140-0x0000000001070000-0x000000000109C000-memory.dmpFilesize
176KB
-
memory/1784-134-0x0000000002DB0000-0x0000000002DB4000-memory.dmpFilesize
16KB
-
memory/3848-135-0x0000000000000000-mapping.dmp
-
memory/3848-137-0x0000000000DC0000-0x0000000000DEC000-memory.dmpFilesize
176KB
-
memory/4264-133-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/4264-132-0x0000000000000000-mapping.dmp
-
memory/4264-136-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/4264-138-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB