Analysis
-
max time kernel
158s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 07:41
Static task
static1
Behavioral task
behavioral1
Sample
4218b9cf266916690af26776acf29627.exe
Resource
win7-20220812-en
General
-
Target
4218b9cf266916690af26776acf29627.exe
-
Size
576KB
-
MD5
4218b9cf266916690af26776acf29627
-
SHA1
d69e2af929a0d406d7eea8316e9747db1d4a7ff0
-
SHA256
dcc8a16c411d371bf110f3d0bfe6a4224a53810844ef1bc02d3f89f2e02e7c0b
-
SHA512
fad04a07efa85b91c64022f0b9b1fefdc80a59cd9127e6c1d750f803e2377c71793f20add0532ab2ed595cc9a98a8c9d522c6c42bc6fc07cfdfd2eddf9954d05
-
SSDEEP
12288:xWO+lpbKbfO7FoxgcSkgyZyfOL5eJxnS4ta5NG3WlViKY:xWnbKzxgcSkgyZeO0TtWN+
Malware Config
Extracted
formbook
dcn0
ZVx68vDtAMBCwg==
oBMBvsNORkM/O/ox
Ff9pISWkm6eG4lByIspp
c2T42c6CIIF6B8xTxm9XzpVw
bvjhxRbnAC183w==
0lTttSNG4HUDNflyIspp
hPXFlstqiHA/O/ox
WLR+MeerxZ0cNn1ja+IQAYo=
IHRn4xXOVKi477zarG+ObSy7YJA=
Xhf3e+tdAC183w==
Xk0ZAezv2rWH
kngo+vBeSRN7AszNwam3Osmguuqc0MoC
a2Qp7a+E8fSw7LDjpnqEKjsRZA==
3zjy4E7+QM48wg==
YcCmqT3OUNAigVott2pBKiy7YJA=
4+SMeX1juat/5cZ1AZihcyy7YJA=
/+m7sro0OBTl3TMpCw==
i2ctEfe4//a64yklMsgS2J90
+loZ2QKGX0UWgpvErMs=
b9BNCnJWQJS8IfsR0uR3bCy7YJA=
9eiUYE0ynHE/O/ox
F2/75pOIYNg0hzOD99192J8=
Y1xOONdO105okfha33EZ2A==
qYZIIB+dfF0wp1nVWFz067hJ2/qoXEVeAA==
moQMzat7tfKyKPYs
aMZJI/NfUSSpPQUBJ8/11g==
QKMN15GjpHcpyA==
6+S1hTvphhFfoCdj6tw=
DPynhWcnZWho7a0p33EZ2A==
EXY//zDm7ej3Guwo
PSWxPYkk0SNioSdj6tw=
jv+tmhv1ySZloydj6tw=
P8GUV5BhNZflCCBBFg==
IQZ0PWog1lcVVkJYHg==
aOTCq/Cet6AdhSdj6tw=
OBzJrqYS+eac46nZo4aI84kWMEtH
kBzTkbI2LTo/O/ox
a8pwOrU/tyx93a/QrGBpXGQIfZI=
GWoC9K5Mx0GR34urFcDPyQ==
dGxKGM2FI4iAkTOD99192J8=
UqQv8Vkx7WzkCCBBFg==
NcBsPK+YmdZP0cyhY+Lrzw==
zcKbk5oK7NCgFOpa4tHv0g==
uIomFkUTzdWa
QkAF8NuWMZmnPjCFgJBa+Y1t
51w6Gw7c3NyY
IyDnsW89dXaMrAxotF8jGZc=
1s1RHCrCwI8PnVhMY+Lrzw==
zBnRazUUWCsrM5t0SEth
1z4R/XM98Wn3j1RMY+Lrzw==
h3b34yQL3cI8wg==
/+27PhUTzdWa
CO0jnOIoAC183w==
Cn8jz+pyZEfWCCBBFg==
jI4f4NnKFwoSUb4YbnkzePzLv+Sc0MoC
xZnrS1Y+5Sxv1g==
phjYsTTGW8zAMydj6tw=
v7JcJyW3x64phzOD99192J8=
tBJ+Uh3sJxYqbyvrfF6BKjsRZA==
xRTxyfuTgMhGxg==
6ceNTfir2qmQHtxWwqIrI8GQ7h/Te/A2CA==
00gVx7d5/U5soCdj6tw=
Jgvgt58H8MFLfBzTp1VZXCe2ZYg=
1NKRY1QTzdWa
ahmedo.ch
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
4218b9cf266916690af26776acf29627.exedescription pid process target process PID 5072 set thread context of 3684 5072 4218b9cf266916690af26776acf29627.exe 4218b9cf266916690af26776acf29627.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
4218b9cf266916690af26776acf29627.exepid process 3684 4218b9cf266916690af26776acf29627.exe 3684 4218b9cf266916690af26776acf29627.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
4218b9cf266916690af26776acf29627.exedescription pid process target process PID 5072 wrote to memory of 3684 5072 4218b9cf266916690af26776acf29627.exe 4218b9cf266916690af26776acf29627.exe PID 5072 wrote to memory of 3684 5072 4218b9cf266916690af26776acf29627.exe 4218b9cf266916690af26776acf29627.exe PID 5072 wrote to memory of 3684 5072 4218b9cf266916690af26776acf29627.exe 4218b9cf266916690af26776acf29627.exe PID 5072 wrote to memory of 3684 5072 4218b9cf266916690af26776acf29627.exe 4218b9cf266916690af26776acf29627.exe PID 5072 wrote to memory of 3684 5072 4218b9cf266916690af26776acf29627.exe 4218b9cf266916690af26776acf29627.exe PID 5072 wrote to memory of 3684 5072 4218b9cf266916690af26776acf29627.exe 4218b9cf266916690af26776acf29627.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4218b9cf266916690af26776acf29627.exe"C:\Users\Admin\AppData\Local\Temp\4218b9cf266916690af26776acf29627.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\4218b9cf266916690af26776acf29627.exe"C:\Users\Admin\AppData\Local\Temp\4218b9cf266916690af26776acf29627.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3684
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3684-137-0x0000000000000000-mapping.dmp
-
memory/3684-138-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3684-140-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3684-141-0x0000000000401000-0x000000000042E000-memory.dmpFilesize
180KB
-
memory/3684-142-0x0000000001690000-0x00000000019DA000-memory.dmpFilesize
3.3MB
-
memory/5072-132-0x0000000000340000-0x00000000003D6000-memory.dmpFilesize
600KB
-
memory/5072-133-0x00000000053A0000-0x0000000005944000-memory.dmpFilesize
5.6MB
-
memory/5072-134-0x0000000004DF0000-0x0000000004E82000-memory.dmpFilesize
584KB
-
memory/5072-135-0x0000000004D90000-0x0000000004D9A000-memory.dmpFilesize
40KB
-
memory/5072-136-0x0000000007790000-0x000000000782C000-memory.dmpFilesize
624KB