Analysis
-
max time kernel
202s -
max time network
210s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 09:16
Static task
static1
Behavioral task
behavioral1
Sample
c21d40e8cd713a1dbdf6491abd9ce3dc11ba3f3312c7081fcb3be353b8b8e89f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c21d40e8cd713a1dbdf6491abd9ce3dc11ba3f3312c7081fcb3be353b8b8e89f.exe
Resource
win10v2004-20221111-en
General
-
Target
c21d40e8cd713a1dbdf6491abd9ce3dc11ba3f3312c7081fcb3be353b8b8e89f.exe
-
Size
107KB
-
MD5
37f9766153ea52766d11839868f10648
-
SHA1
76e435f2b25879da5da13e56f8a0400386abd715
-
SHA256
c21d40e8cd713a1dbdf6491abd9ce3dc11ba3f3312c7081fcb3be353b8b8e89f
-
SHA512
22a1f05930bd87f97f7b5f8da2ea48accba00f0b7cf6504ab606f6aac5a3458a11fecb4f2a63349ccf27bbceb22ac4127e3dd618daf6f106e7fbc4ee57377972
-
SSDEEP
1536:jvCx8bNEZ05v1yhBdMYoMS0gmYYNkKKHrdSTruSXMl7Eqk1oJqG1M:TCqo0mBdHoMSvmjkrH+u979yoL
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\hpoqwxtt = "\"C:\\Users\\Admin\\AppData\\Local\\cfmktnvw.exe\"" svchost.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
c21d40e8cd713a1dbdf6491abd9ce3dc11ba3f3312c7081fcb3be353b8b8e89f.exepid process 2028 c21d40e8cd713a1dbdf6491abd9ce3dc11ba3f3312c7081fcb3be353b8b8e89f.exe 2028 c21d40e8cd713a1dbdf6491abd9ce3dc11ba3f3312c7081fcb3be353b8b8e89f.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
c21d40e8cd713a1dbdf6491abd9ce3dc11ba3f3312c7081fcb3be353b8b8e89f.exedescription pid process target process PID 2028 wrote to memory of 940 2028 c21d40e8cd713a1dbdf6491abd9ce3dc11ba3f3312c7081fcb3be353b8b8e89f.exe svchost.exe PID 2028 wrote to memory of 940 2028 c21d40e8cd713a1dbdf6491abd9ce3dc11ba3f3312c7081fcb3be353b8b8e89f.exe svchost.exe PID 2028 wrote to memory of 940 2028 c21d40e8cd713a1dbdf6491abd9ce3dc11ba3f3312c7081fcb3be353b8b8e89f.exe svchost.exe PID 2028 wrote to memory of 940 2028 c21d40e8cd713a1dbdf6491abd9ce3dc11ba3f3312c7081fcb3be353b8b8e89f.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c21d40e8cd713a1dbdf6491abd9ce3dc11ba3f3312c7081fcb3be353b8b8e89f.exe"C:\Users\Admin\AppData\Local\Temp\c21d40e8cd713a1dbdf6491abd9ce3dc11ba3f3312c7081fcb3be353b8b8e89f.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/940-56-0x0000000000000000-mapping.dmp
-
memory/940-57-0x0000000075C21000-0x0000000075C23000-memory.dmpFilesize
8KB
-
memory/940-58-0x00000000007F0000-0x00000000007F8000-memory.dmpFilesize
32KB
-
memory/940-59-0x00000000000C0000-0x00000000000D1000-memory.dmpFilesize
68KB
-
memory/940-60-0x0000000000150000-0x00000000001D0000-memory.dmpFilesize
512KB
-
memory/2028-54-0x0000000000020000-0x0000000000034000-memory.dmpFilesize
80KB