Analysis
-
max time kernel
236s -
max time network
325s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 19:15
Static task
static1
Behavioral task
behavioral1
Sample
82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exe
Resource
win10v2004-20221111-en
General
-
Target
82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exe
-
Size
1.6MB
-
MD5
f363705d1644da2dbb272217a9784543
-
SHA1
e4876aa2a1280780465da8281a1ef6c5530f87aa
-
SHA256
82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284
-
SHA512
1c8c5ab66769c769b226bdd6af96636c3cbd0cc48225457e643802070dd1555870f9e65270a3873973530d5df2eba508625e012075a15d457ecd7eb800417a68
-
SSDEEP
24576:BzD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUYo:T6/ye0PIphrp9Zuvjqa0Uidj
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exedescription pid process target process PID 1952 set thread context of 3808 1952 82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exe 82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exepid process 3808 82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exe 3808 82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exe 3808 82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exe 3808 82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exe 3808 82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exedescription pid process target process PID 1952 wrote to memory of 3808 1952 82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exe 82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exe PID 1952 wrote to memory of 3808 1952 82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exe 82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exe PID 1952 wrote to memory of 3808 1952 82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exe 82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exe PID 1952 wrote to memory of 3808 1952 82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exe 82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exe PID 1952 wrote to memory of 3808 1952 82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exe 82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exe PID 1952 wrote to memory of 3808 1952 82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exe 82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exe PID 1952 wrote to memory of 3808 1952 82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exe 82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exe PID 1952 wrote to memory of 3808 1952 82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exe 82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exe PID 1952 wrote to memory of 3808 1952 82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exe 82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exe PID 1952 wrote to memory of 3808 1952 82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exe 82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exe"C:\Users\Admin\AppData\Local\Temp\82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exe"C:\Users\Admin\AppData\Local\Temp\82d2419bff006da4bd0394289d974d7112942c565539bbe4062f320e2d8a9284.exe"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3808-132-0x0000000000000000-mapping.dmp
-
memory/3808-133-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/3808-134-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/3808-135-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/3808-136-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/3808-137-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB