Analysis
-
max time kernel
193s -
max time network
229s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29/11/2022, 14:32
Behavioral task
behavioral1
Sample
8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe
Resource
win7-20221111-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe
-
Size
413KB
-
MD5
289019443a24fd0e3aa5e2cca01f9dc0
-
SHA1
63ea3fbca9a82e87e6194882bc2a15175441e755
-
SHA256
8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b
-
SHA512
e8bbb5390e0a55251a508bf21f33798ee2d3ce23cdbbd99c8aa3658063b2784806d6ae971ca87dd7c15707c12add0423efdb37864d6e6cfac9f884cc57de35b7
-
SSDEEP
6144:dePaZGD9/ce97xLPZMDJr+yj9aJmcbubR+RBxd+bdIzu2souDSeLfQqIqODO4DVt:dQaZ09EeNFu1r2mcbmMRNKPont
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\protocol 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe File opened for modification C:\Windows\System32\drivers\etc\protocol csrss -
Executes dropped EXE 2 IoCs
pid Process 2648 csrss 4424 csrss -
resource yara_rule behavioral2/memory/1668-134-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral2/memory/112-138-0x0000000000400000-0x000000000048D000-memory.dmp upx behavioral2/memory/1668-140-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral2/memory/112-139-0x0000000000400000-0x000000000048D000-memory.dmp upx behavioral2/memory/112-141-0x0000000000400000-0x000000000048D000-memory.dmp upx behavioral2/memory/112-142-0x0000000000400000-0x000000000048D000-memory.dmp upx behavioral2/memory/112-143-0x0000000000400000-0x000000000048D000-memory.dmp upx behavioral2/files/0x000b000000022e0a-145.dat upx behavioral2/files/0x000b000000022e0a-146.dat upx behavioral2/memory/2648-147-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral2/files/0x000b000000022e0a-150.dat upx behavioral2/memory/2648-152-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral2/memory/4424-155-0x0000000000400000-0x000000000048D000-memory.dmp upx behavioral2/memory/4424-156-0x0000000000400000-0x000000000048D000-memory.dmp upx -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1668 set thread context of 112 1668 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 84 PID 2648 set thread context of 4424 2648 csrss 86 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1668 wrote to memory of 112 1668 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 84 PID 1668 wrote to memory of 112 1668 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 84 PID 1668 wrote to memory of 112 1668 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 84 PID 1668 wrote to memory of 112 1668 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 84 PID 1668 wrote to memory of 112 1668 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 84 PID 1668 wrote to memory of 112 1668 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 84 PID 1668 wrote to memory of 112 1668 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 84 PID 1668 wrote to memory of 112 1668 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 84 PID 112 wrote to memory of 2648 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 85 PID 112 wrote to memory of 2648 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 85 PID 112 wrote to memory of 2648 112 8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe 85 PID 2648 wrote to memory of 4424 2648 csrss 86 PID 2648 wrote to memory of 4424 2648 csrss 86 PID 2648 wrote to memory of 4424 2648 csrss 86 PID 2648 wrote to memory of 4424 2648 csrss 86 PID 2648 wrote to memory of 4424 2648 csrss 86 PID 2648 wrote to memory of 4424 2648 csrss 86 PID 2648 wrote to memory of 4424 2648 csrss 86 PID 2648 wrote to memory of 4424 2648 csrss 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe"C:\Users\Admin\AppData\Local\Temp\8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe"C:\Users\Admin\AppData\Local\Temp\8457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b.exe"2⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Users\Admin\csrssC:\Users\Admin\csrss3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\csrss"C:\Users\Admin\csrss"4⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:4424
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
413KB
MD5289019443a24fd0e3aa5e2cca01f9dc0
SHA163ea3fbca9a82e87e6194882bc2a15175441e755
SHA2568457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b
SHA512e8bbb5390e0a55251a508bf21f33798ee2d3ce23cdbbd99c8aa3658063b2784806d6ae971ca87dd7c15707c12add0423efdb37864d6e6cfac9f884cc57de35b7
-
Filesize
413KB
MD5289019443a24fd0e3aa5e2cca01f9dc0
SHA163ea3fbca9a82e87e6194882bc2a15175441e755
SHA2568457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b
SHA512e8bbb5390e0a55251a508bf21f33798ee2d3ce23cdbbd99c8aa3658063b2784806d6ae971ca87dd7c15707c12add0423efdb37864d6e6cfac9f884cc57de35b7
-
Filesize
413KB
MD5289019443a24fd0e3aa5e2cca01f9dc0
SHA163ea3fbca9a82e87e6194882bc2a15175441e755
SHA2568457f414a1792460bc19a59d74c3715974c5af967197121245f0a0ebe7231d8b
SHA512e8bbb5390e0a55251a508bf21f33798ee2d3ce23cdbbd99c8aa3658063b2784806d6ae971ca87dd7c15707c12add0423efdb37864d6e6cfac9f884cc57de35b7