Analysis
-
max time kernel
158s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 16:34
Static task
static1
Behavioral task
behavioral1
Sample
9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exe
Resource
win10v2004-20221111-en
General
-
Target
9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exe
-
Size
1.2MB
-
MD5
67ccf530170b28623fe752a4cd521bb8
-
SHA1
77aab00b5e4e3f46dee33b69121578bf380762ba
-
SHA256
9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18
-
SHA512
88fa53f9ce39de62b5e3122cecebf1ddc825cadbc2aa120be5060f5d9dc2154497f0c4ad54243b2fca9ca980116d3d2163af281445180f08ef195cd87b90bf61
-
SSDEEP
12288:dSGxzDKw6w2qa3LgMc8SLFDY/8LeS2899E7D3AYNACMzb7noKcxl4B6obXWRAfby:cxw8wFDY3wE3wY6cxI6gWUbIwMLHf/
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exedescription pid process target process PID 2412 set thread context of 1696 2412 9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exe 9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exepid process 1696 9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exe 1696 9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exe 1696 9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exe 1696 9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exe 1696 9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exedescription pid process target process PID 2412 wrote to memory of 1696 2412 9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exe 9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exe PID 2412 wrote to memory of 1696 2412 9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exe 9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exe PID 2412 wrote to memory of 1696 2412 9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exe 9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exe PID 2412 wrote to memory of 1696 2412 9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exe 9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exe PID 2412 wrote to memory of 1696 2412 9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exe 9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exe PID 2412 wrote to memory of 1696 2412 9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exe 9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exe PID 2412 wrote to memory of 1696 2412 9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exe 9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exe PID 2412 wrote to memory of 1696 2412 9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exe 9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exe PID 2412 wrote to memory of 1696 2412 9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exe 9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exe PID 2412 wrote to memory of 1696 2412 9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exe 9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exe"C:\Users\Admin\AppData\Local\Temp\9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exe"C:\Users\Admin\AppData\Local\Temp\9ecae1e3dd1bcc0aedf66827b87296b22f7d6fa244357c7bc56cc1c90a1f5e18.exe"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1696-132-0x0000000000000000-mapping.dmp
-
memory/1696-133-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/1696-134-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/1696-135-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/1696-136-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/1696-137-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/1696-138-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB