Analysis
-
max time kernel
146s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 16:29
Static task
static1
Behavioral task
behavioral1
Sample
9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exe
Resource
win10v2004-20220812-en
General
-
Target
9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exe
-
Size
1.3MB
-
MD5
0bbde30bb28069e3fa1a2a397c653330
-
SHA1
60a60f73971248555078cca35e856c959a0be4ca
-
SHA256
9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699
-
SHA512
25f6c38f39c2d4b3ab90bb79e623121d86955fca8207708af16b540a6a8dd6a4d405c3f0c8fc4e4cc82a1d371308e65f7752d23bf59f4ac9fea6bfd61268dd06
-
SSDEEP
24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak:7rKo4ZwCOnYjVmJPa
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exedescription pid process target process PID 736 set thread context of 3108 736 9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exe 9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exepid process 3108 9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exe 3108 9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exe 3108 9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exe 3108 9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exe 3108 9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exedescription pid process target process PID 736 wrote to memory of 3108 736 9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exe 9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exe PID 736 wrote to memory of 3108 736 9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exe 9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exe PID 736 wrote to memory of 3108 736 9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exe 9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exe PID 736 wrote to memory of 3108 736 9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exe 9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exe PID 736 wrote to memory of 3108 736 9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exe 9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exe PID 736 wrote to memory of 3108 736 9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exe 9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exe PID 736 wrote to memory of 3108 736 9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exe 9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exe PID 736 wrote to memory of 3108 736 9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exe 9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exe PID 736 wrote to memory of 3108 736 9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exe 9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exe PID 736 wrote to memory of 3108 736 9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exe 9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exe"C:\Users\Admin\AppData\Local\Temp\9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9fc372934150305150e6fc13b10c6c9344b223e3561268f8f27d2c7db0369699.exe
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3108-132-0x0000000000000000-mapping.dmp
-
memory/3108-133-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/3108-134-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/3108-135-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/3108-136-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/3108-137-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB