Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 07:21
Static task
static1
Behavioral task
behavioral1
Sample
9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe
Resource
win10v2004-20220812-en
General
-
Target
9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe
-
Size
260KB
-
MD5
105833e760b09cbde85e0077f9e9d49e
-
SHA1
3f08a1c94510574f013debac02f93fcdec7ab796
-
SHA256
9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2
-
SHA512
92258448944a1c9e95212ba2cda0cd172a08ca772712a93da4a7f456e622ce49a2c2e8f67ae332fd5bdad95548aa67202dc3e97db794b0fb05dabf6cb36e43ed
-
SSDEEP
6144:dT79rfiNK9tqna0atlq3w27v00L2gubvsznNH/f:dTprfga0P3cgz5f
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
explorer.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3224346.exe explorer.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\322434 = "C:\\3224346\\3224346.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*22434 = "C:\\3224346\\3224346.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3224346 = "C:\\Users\\Admin\\AppData\\Roaming\\3224346.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*224346 = "C:\\Users\\Admin\\AppData\\Roaming\\3224346.exe" explorer.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exedescription pid process target process PID 4812 set thread context of 4324 4812 9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe 9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exepid process 4812 9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe 4812 9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exeexplorer.exepid process 4324 9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe 4656 explorer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exepid process 4812 9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exeexplorer.exedescription pid process target process PID 4812 wrote to memory of 4324 4812 9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe 9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe PID 4812 wrote to memory of 4324 4812 9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe 9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe PID 4812 wrote to memory of 4324 4812 9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe 9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe PID 4812 wrote to memory of 4324 4812 9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe 9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe PID 4812 wrote to memory of 4324 4812 9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe 9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe PID 4812 wrote to memory of 4324 4812 9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe 9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe PID 4812 wrote to memory of 4324 4812 9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe 9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe PID 4812 wrote to memory of 4324 4812 9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe 9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe PID 4812 wrote to memory of 4324 4812 9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe 9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe PID 4324 wrote to memory of 4656 4324 9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe explorer.exe PID 4324 wrote to memory of 4656 4324 9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe explorer.exe PID 4324 wrote to memory of 4656 4324 9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe explorer.exe PID 4656 wrote to memory of 2092 4656 explorer.exe svchost.exe PID 4656 wrote to memory of 2092 4656 explorer.exe svchost.exe PID 4656 wrote to memory of 2092 4656 explorer.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe"C:\Users\Admin\AppData\Local\Temp\9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exeC:\Users\Admin\AppData\Local\Temp\9fa123ab8324a0ff02101b973cc07e91c33811f2165d2412e5959cd68a96a8d2.exe2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\syswow64\explorer.exe"3⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Windows\SysWOW64\svchost.exe-k netsvcs4⤵PID:2092
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2092-139-0x0000000000000000-mapping.dmp
-
memory/2092-140-0x0000000000B40000-0x0000000000B6B000-memory.dmpFilesize
172KB
-
memory/4324-132-0x0000000000000000-mapping.dmp
-
memory/4324-133-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/4324-135-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/4324-137-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/4656-136-0x0000000000000000-mapping.dmp
-
memory/4656-138-0x0000000000CB0000-0x0000000000CDB000-memory.dmpFilesize
172KB
-
memory/4812-134-0x00000000023A0000-0x00000000023A4000-memory.dmpFilesize
16KB