Analysis
-
max time kernel
43s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 06:50
Static task
static1
Behavioral task
behavioral1
Sample
e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe
Resource
win10v2004-20220901-en
General
-
Target
e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe
-
Size
925KB
-
MD5
78e50558d4c6ce263df890da0918fff2
-
SHA1
73fb0ed1d4b09ff929cc0402723dc22fdad94675
-
SHA256
e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60
-
SHA512
2fa1a433d4286e8b46dc27aea29f42822a15767121a02baa5b30afba4e11c98322525b67e1f17a437a4d1cb3a0e17e5db9941498428f639b504988ea90b05897
-
SSDEEP
12288:Qmf8PzkvaBHmLV8P22zx+kdJ00Bvuyymhcx1UG6HyNrSjqOuPn6mc2RREYJaRv:LSkv/VCWkdJ0OpGmyNtjPn68REYst
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/112-55-0x0000000000400000-0x00000000004E9000-memory.dmp upx behavioral1/memory/112-57-0x0000000000400000-0x00000000004E9000-memory.dmp upx behavioral1/memory/112-58-0x0000000000400000-0x00000000004E9000-memory.dmp upx behavioral1/memory/112-62-0x0000000000400000-0x00000000004E9000-memory.dmp upx behavioral1/memory/112-63-0x0000000000400000-0x00000000004E9000-memory.dmp upx behavioral1/memory/112-64-0x0000000000400000-0x00000000004E9000-memory.dmp upx behavioral1/memory/112-65-0x0000000000400000-0x00000000004E9000-memory.dmp upx behavioral1/memory/112-66-0x0000000000400000-0x00000000004E9000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exedescription pid process target process PID 1676 set thread context of 112 1676 e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe -
Processes:
e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exepid process 112 e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe 112 e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe 112 e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe 112 e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe 112 e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exedescription pid process target process PID 1676 wrote to memory of 112 1676 e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe PID 1676 wrote to memory of 112 1676 e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe PID 1676 wrote to memory of 112 1676 e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe PID 1676 wrote to memory of 112 1676 e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe PID 1676 wrote to memory of 112 1676 e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe PID 1676 wrote to memory of 112 1676 e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe PID 1676 wrote to memory of 112 1676 e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe PID 1676 wrote to memory of 112 1676 e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe"C:\Users\Admin\AppData\Local\Temp\e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe"C:\Users\Admin\AppData\Local\Temp\e82bb301ef0517e0d0b2ac9ed087d4e8458b3867fc5b975381adfaca816c8a60.exe"2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/112-54-0x0000000000400000-0x00000000004E9000-memory.dmpFilesize
932KB
-
memory/112-55-0x0000000000400000-0x00000000004E9000-memory.dmpFilesize
932KB
-
memory/112-57-0x0000000000400000-0x00000000004E9000-memory.dmpFilesize
932KB
-
memory/112-58-0x0000000000400000-0x00000000004E9000-memory.dmpFilesize
932KB
-
memory/112-59-0x00000000004E76D0-mapping.dmp
-
memory/112-61-0x0000000075E31000-0x0000000075E33000-memory.dmpFilesize
8KB
-
memory/112-62-0x0000000000400000-0x00000000004E9000-memory.dmpFilesize
932KB
-
memory/112-63-0x0000000000400000-0x00000000004E9000-memory.dmpFilesize
932KB
-
memory/112-64-0x0000000000400000-0x00000000004E9000-memory.dmpFilesize
932KB
-
memory/112-65-0x0000000000400000-0x00000000004E9000-memory.dmpFilesize
932KB
-
memory/112-66-0x0000000000400000-0x00000000004E9000-memory.dmpFilesize
932KB