Analysis

  • max time kernel
    124s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/11/2022, 23:01

General

  • Target

    17ce587672840757b294be8b4e14243904a8575af9de06e0c85399e7ac8edeef.exe

  • Size

    11.2MB

  • MD5

    0dc4b2e49e615df84623b7e758043868

  • SHA1

    5274effd36a031e275e6d137e26a5c8f3a2b7429

  • SHA256

    17ce587672840757b294be8b4e14243904a8575af9de06e0c85399e7ac8edeef

  • SHA512

    00abd743d21bea15c67578c84406305753edeef35c92697e7d6fe0cf02033802cee51d8756b7471350ff58ed79ab35b300a9432cea7af1562f2124655fa57064

  • SSDEEP

    196608:YHbYxXJLo4soHOZcfMcQ1mLdtBOCNWeklIsGhIjsi2b/EAzUIdM5pz4FmYsc:YbGFo4soHOZ6McK4tICN5Jsrjsik/FP7

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\17ce587672840757b294be8b4e14243904a8575af9de06e0c85399e7ac8edeef.exe
    "C:\Users\Admin\AppData\Local\Temp\17ce587672840757b294be8b4e14243904a8575af9de06e0c85399e7ac8edeef.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1780
    • C:\Users\Admin\AppData\Local\Temp\is-2SJRK.tmp\17ce587672840757b294be8b4e14243904a8575af9de06e0c85399e7ac8edeef.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-2SJRK.tmp\17ce587672840757b294be8b4e14243904a8575af9de06e0c85399e7ac8edeef.tmp" /SL5="$901C2,11436826,56832,C:\Users\Admin\AppData\Local\Temp\17ce587672840757b294be8b4e14243904a8575af9de06e0c85399e7ac8edeef.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:2508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-2SJRK.tmp\17ce587672840757b294be8b4e14243904a8575af9de06e0c85399e7ac8edeef.tmp

    Filesize

    690KB

    MD5

    1305181de520f125aeabf85dc24a89d6

    SHA1

    98b7548fede3f1468ccbdee405abdc4e5d2ec671

    SHA256

    0e19765b89a1a29afee09810dcb3ec5cc7c66053947be8f1aebdbb7c801dfeaf

    SHA512

    b0bfa9749a6a5a18c1926e6c5ebb4cdb156df1652cb822f067422a1cd21583340f32e4a1fc2f4c21a09343d73a55651972edbd2dec98ce44641a1097c16bc793

  • C:\Users\Admin\AppData\Local\Temp\is-2SJRK.tmp\17ce587672840757b294be8b4e14243904a8575af9de06e0c85399e7ac8edeef.tmp

    Filesize

    690KB

    MD5

    1305181de520f125aeabf85dc24a89d6

    SHA1

    98b7548fede3f1468ccbdee405abdc4e5d2ec671

    SHA256

    0e19765b89a1a29afee09810dcb3ec5cc7c66053947be8f1aebdbb7c801dfeaf

    SHA512

    b0bfa9749a6a5a18c1926e6c5ebb4cdb156df1652cb822f067422a1cd21583340f32e4a1fc2f4c21a09343d73a55651972edbd2dec98ce44641a1097c16bc793

  • C:\Users\Admin\AppData\Local\Temp\is-EA1UL.tmp\Office2007.cjstyles

    Filesize

    624KB

    MD5

    32a4c49ff3b8b4b8a8831e6d70ccbeaa

    SHA1

    dda5601b8e100a5091e6898bb3d23e1b68833c51

    SHA256

    157f7e47a9f7ed38ce35bef17606ff1026fe49ef8a71fb840c088d92fe6d36bd

    SHA512

    d8113e949c3f9e15904215f4bda825e7d2d11a4e96279c9e6421c96ebb8c05bf16e2114d735bd4fd2dce8f1a75fe6f6cdda3116bbdcaf6d821f0336849a5ca64

  • C:\Users\Admin\AppData\Local\Temp\is-EA1UL.tmp\Office2007.cjstyles

    Filesize

    624KB

    MD5

    32a4c49ff3b8b4b8a8831e6d70ccbeaa

    SHA1

    dda5601b8e100a5091e6898bb3d23e1b68833c51

    SHA256

    157f7e47a9f7ed38ce35bef17606ff1026fe49ef8a71fb840c088d92fe6d36bd

    SHA512

    d8113e949c3f9e15904215f4bda825e7d2d11a4e96279c9e6421c96ebb8c05bf16e2114d735bd4fd2dce8f1a75fe6f6cdda3116bbdcaf6d821f0336849a5ca64

  • C:\Users\Admin\AppData\Local\Temp\is-EA1UL.tmp\isskin.dll

    Filesize

    385KB

    MD5

    92c2e247392e0e02261dea67e1bb1a5e

    SHA1

    db72fed8771364bf8039b2bc83ed01dda2908554

    SHA256

    25fdb94e386f8a41f10aba00ed092a91b878339f8e256a7252b11169122b0a68

    SHA512

    e938d2a1870ccb437d818b5301e6ecffaa6efbf4f0122e1a1ae0981057d7d0376039ea927c6fd326456da2d6904803fca26b87245367a4c5de2aebc47bdcd4b5

  • memory/1780-132-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/1780-137-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/1780-273-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2508-167-0x0000000075D80000-0x0000000075E2F000-memory.dmp

    Filesize

    700KB

  • memory/2508-172-0x0000000076660000-0x0000000076C13000-memory.dmp

    Filesize

    5.7MB

  • memory/2508-143-0x0000000077950000-0x00000000779CA000-memory.dmp

    Filesize

    488KB

  • memory/2508-144-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/2508-145-0x0000000077950000-0x00000000779CA000-memory.dmp

    Filesize

    488KB

  • memory/2508-146-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/2508-147-0x0000000077950000-0x00000000779CA000-memory.dmp

    Filesize

    488KB

  • memory/2508-148-0x0000000077230000-0x0000000077255000-memory.dmp

    Filesize

    148KB

  • memory/2508-150-0x0000000077950000-0x00000000779CA000-memory.dmp

    Filesize

    488KB

  • memory/2508-149-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/2508-156-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/2508-155-0x0000000077230000-0x0000000077255000-memory.dmp

    Filesize

    148KB

  • memory/2508-154-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/2508-153-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/2508-152-0x0000000074C30000-0x0000000074C60000-memory.dmp

    Filesize

    192KB

  • memory/2508-151-0x0000000077230000-0x0000000077255000-memory.dmp

    Filesize

    148KB

  • memory/2508-157-0x0000000074A70000-0x0000000074B94000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-158-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/2508-159-0x0000000076C30000-0x0000000076D13000-memory.dmp

    Filesize

    908KB

  • memory/2508-160-0x0000000076660000-0x0000000076C13000-memory.dmp

    Filesize

    5.7MB

  • memory/2508-161-0x0000000075D80000-0x0000000075E2F000-memory.dmp

    Filesize

    700KB

  • memory/2508-162-0x0000000075880000-0x0000000075A90000-memory.dmp

    Filesize

    2.1MB

  • memory/2508-163-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/2508-164-0x00000000761F0000-0x00000000762CC000-memory.dmp

    Filesize

    880KB

  • memory/2508-165-0x0000000076C30000-0x0000000076D13000-memory.dmp

    Filesize

    908KB

  • memory/2508-166-0x0000000076660000-0x0000000076C13000-memory.dmp

    Filesize

    5.7MB

  • memory/2508-141-0x0000000077950000-0x00000000779CA000-memory.dmp

    Filesize

    488KB

  • memory/2508-168-0x0000000075880000-0x0000000075A90000-memory.dmp

    Filesize

    2.1MB

  • memory/2508-169-0x0000000075800000-0x0000000075874000-memory.dmp

    Filesize

    464KB

  • memory/2508-170-0x0000000074A70000-0x0000000074B94000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-171-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/2508-142-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/2508-173-0x0000000075D80000-0x0000000075E2F000-memory.dmp

    Filesize

    700KB

  • memory/2508-175-0x0000000075800000-0x0000000075874000-memory.dmp

    Filesize

    464KB

  • memory/2508-174-0x0000000075880000-0x0000000075A90000-memory.dmp

    Filesize

    2.1MB

  • memory/2508-177-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/2508-176-0x0000000074A70000-0x0000000074B94000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-178-0x0000000076660000-0x0000000076C13000-memory.dmp

    Filesize

    5.7MB

  • memory/2508-179-0x0000000075D80000-0x0000000075E2F000-memory.dmp

    Filesize

    700KB

  • memory/2508-180-0x0000000075880000-0x0000000075A90000-memory.dmp

    Filesize

    2.1MB

  • memory/2508-181-0x0000000077230000-0x0000000077255000-memory.dmp

    Filesize

    148KB

  • memory/2508-182-0x0000000075800000-0x0000000075874000-memory.dmp

    Filesize

    464KB

  • memory/2508-183-0x0000000074A70000-0x0000000074B94000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-184-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/2508-185-0x0000000076660000-0x0000000076C13000-memory.dmp

    Filesize

    5.7MB

  • memory/2508-186-0x0000000075D80000-0x0000000075E2F000-memory.dmp

    Filesize

    700KB

  • memory/2508-187-0x0000000075880000-0x0000000075A90000-memory.dmp

    Filesize

    2.1MB

  • memory/2508-188-0x0000000075800000-0x0000000075874000-memory.dmp

    Filesize

    464KB

  • memory/2508-189-0x0000000074A70000-0x0000000074B94000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-191-0x00000000761F0000-0x00000000762CC000-memory.dmp

    Filesize

    880KB

  • memory/2508-190-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/2508-192-0x0000000076C30000-0x0000000076D13000-memory.dmp

    Filesize

    908KB

  • memory/2508-193-0x0000000076660000-0x0000000076C13000-memory.dmp

    Filesize

    5.7MB

  • memory/2508-195-0x0000000075880000-0x0000000075A90000-memory.dmp

    Filesize

    2.1MB

  • memory/2508-196-0x0000000075800000-0x0000000075874000-memory.dmp

    Filesize

    464KB

  • memory/2508-194-0x0000000075D80000-0x0000000075E2F000-memory.dmp

    Filesize

    700KB

  • memory/2508-198-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/2508-197-0x0000000074A70000-0x0000000074B94000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-199-0x0000000076660000-0x0000000076C13000-memory.dmp

    Filesize

    5.7MB

  • memory/2508-200-0x0000000075880000-0x0000000075A90000-memory.dmp

    Filesize

    2.1MB

  • memory/2508-201-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/2508-202-0x0000000076660000-0x0000000076C13000-memory.dmp

    Filesize

    5.7MB