Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 00:48
Static task
static1
Behavioral task
behavioral1
Sample
3ff1b1faae2179aeb59d3ba080110e138f25e24f66bc52bf304ec269f012d550.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
3ff1b1faae2179aeb59d3ba080110e138f25e24f66bc52bf304ec269f012d550.exe
Resource
win10v2004-20220812-en
General
-
Target
3ff1b1faae2179aeb59d3ba080110e138f25e24f66bc52bf304ec269f012d550.exe
-
Size
7.0MB
-
MD5
adf3a9d53352bfbb476698ba6af45434
-
SHA1
25540b88c67d61f8766f9d1284c721754f011978
-
SHA256
3ff1b1faae2179aeb59d3ba080110e138f25e24f66bc52bf304ec269f012d550
-
SHA512
adcff3fde82b1c7dec4ed4a3eeff81c4b87d3e4045746149f18858e14beec9b44c68cc4f2df7392d631f3648e8c488bbc1e05b55a21fcc3f701d68802a7999d6
-
SSDEEP
98304:cepGTo0F7jR9pF6vhyFkf84hSyQt9Hwq2SJPaNRb7nPdDwQVD7y:B4ZjR9yyG04hbQUSQRXnlDwQVDG
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
zesoeo5.dllpid process 4840 zesoeo5.dll -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\zesoeo5.dll vmprotect C:\Users\Admin\AppData\Local\Temp\zesoeo5.dll vmprotect behavioral2/memory/4840-135-0x0000000000400000-0x0000000000762000-memory.dmp vmprotect behavioral2/memory/4840-136-0x0000000000400000-0x0000000000762000-memory.dmp vmprotect behavioral2/memory/4840-139-0x0000000000400000-0x0000000000762000-memory.dmp vmprotect -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
3ff1b1faae2179aeb59d3ba080110e138f25e24f66bc52bf304ec269f012d550.exezesoeo5.dllpid process 4964 3ff1b1faae2179aeb59d3ba080110e138f25e24f66bc52bf304ec269f012d550.exe 4964 3ff1b1faae2179aeb59d3ba080110e138f25e24f66bc52bf304ec269f012d550.exe 4840 zesoeo5.dll 4840 zesoeo5.dll -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
3ff1b1faae2179aeb59d3ba080110e138f25e24f66bc52bf304ec269f012d550.exedescription pid process target process PID 4964 wrote to memory of 4840 4964 3ff1b1faae2179aeb59d3ba080110e138f25e24f66bc52bf304ec269f012d550.exe zesoeo5.dll PID 4964 wrote to memory of 4840 4964 3ff1b1faae2179aeb59d3ba080110e138f25e24f66bc52bf304ec269f012d550.exe zesoeo5.dll PID 4964 wrote to memory of 4840 4964 3ff1b1faae2179aeb59d3ba080110e138f25e24f66bc52bf304ec269f012d550.exe zesoeo5.dll
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ff1b1faae2179aeb59d3ba080110e138f25e24f66bc52bf304ec269f012d550.exe"C:\Users\Admin\AppData\Local\Temp\3ff1b1faae2179aeb59d3ba080110e138f25e24f66bc52bf304ec269f012d550.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\zesoeo5.dllC:\Users\Admin\AppData\Local\Temp\\zesoeo5.dll2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\zesoeo5.dllFilesize
1.4MB
MD5c92f1112358c8797fbe987c53958b924
SHA184d9a09a9daddfb873ef63e3982cc591c65b61f4
SHA2562c91e80d1b5d245d608982bd28451cd6f77fb51edb8117ff9c2958766fc17a54
SHA5127111b3f0168d0975494d5d6efeec818c49280cd705a8bb2f95e25a68e5bad661ec574dc2dff9800f066d02926976cd0e68f3ff078f27cef628d2745bcb6bca21
-
C:\Users\Admin\AppData\Local\Temp\zesoeo5.dllFilesize
1.4MB
MD5c92f1112358c8797fbe987c53958b924
SHA184d9a09a9daddfb873ef63e3982cc591c65b61f4
SHA2562c91e80d1b5d245d608982bd28451cd6f77fb51edb8117ff9c2958766fc17a54
SHA5127111b3f0168d0975494d5d6efeec818c49280cd705a8bb2f95e25a68e5bad661ec574dc2dff9800f066d02926976cd0e68f3ff078f27cef628d2745bcb6bca21
-
memory/4840-132-0x0000000000000000-mapping.dmp
-
memory/4840-135-0x0000000000400000-0x0000000000762000-memory.dmpFilesize
3.4MB
-
memory/4840-136-0x0000000000400000-0x0000000000762000-memory.dmpFilesize
3.4MB
-
memory/4840-139-0x0000000000400000-0x0000000000762000-memory.dmpFilesize
3.4MB