Analysis

  • max time kernel
    189s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    30-11-2022 18:31

General

  • Target

    f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe

  • Size

    422KB

  • MD5

    f3c7542ddd9b9479f5904e1b6ba67f95

  • SHA1

    fd45581c675f6646adb9427ad296c91062e55423

  • SHA256

    f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3

  • SHA512

    1744fcece1a88d7d4ca986f43e3ed76f57306643c1adb55a7fcb0acd1d18ea45a01bd53d267501d6dfde0d923447b9dbc14c87fc0ddfe47621e564012ada3e13

  • SSDEEP

    6144:T062e/kYFnSwsCyuMj5Gm92/6SOVG9ggtKBUI18HmiI1g6MFyMBpjOhAmTQDHGNM:JjFdsPVGSW7tK91KmNglBpqhvTQTGN

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe
    "C:\Users\Admin\AppData\Local\Temp\f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:936
    • C:\Users\Admin\AppData\Local\Temp\f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe
      "C:\Users\Admin\AppData\Local\Temp\f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1500
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
        dw20.exe -x -s 764
        3⤵
        • Loads dropped DLL
        PID:892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe

    Filesize

    422KB

    MD5

    f3c7542ddd9b9479f5904e1b6ba67f95

    SHA1

    fd45581c675f6646adb9427ad296c91062e55423

    SHA256

    f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3

    SHA512

    1744fcece1a88d7d4ca986f43e3ed76f57306643c1adb55a7fcb0acd1d18ea45a01bd53d267501d6dfde0d923447b9dbc14c87fc0ddfe47621e564012ada3e13

  • \Users\Admin\AppData\Local\Temp\f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe

    Filesize

    422KB

    MD5

    f3c7542ddd9b9479f5904e1b6ba67f95

    SHA1

    fd45581c675f6646adb9427ad296c91062e55423

    SHA256

    f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3

    SHA512

    1744fcece1a88d7d4ca986f43e3ed76f57306643c1adb55a7fcb0acd1d18ea45a01bd53d267501d6dfde0d923447b9dbc14c87fc0ddfe47621e564012ada3e13

  • \Users\Admin\AppData\Local\Temp\f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe

    Filesize

    422KB

    MD5

    f3c7542ddd9b9479f5904e1b6ba67f95

    SHA1

    fd45581c675f6646adb9427ad296c91062e55423

    SHA256

    f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3

    SHA512

    1744fcece1a88d7d4ca986f43e3ed76f57306643c1adb55a7fcb0acd1d18ea45a01bd53d267501d6dfde0d923447b9dbc14c87fc0ddfe47621e564012ada3e13

  • \Users\Admin\AppData\Local\Temp\f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3.exe

    Filesize

    422KB

    MD5

    f3c7542ddd9b9479f5904e1b6ba67f95

    SHA1

    fd45581c675f6646adb9427ad296c91062e55423

    SHA256

    f3ec0cde4a395cdc5da9a2fcd7a2bd3517022b54f939cd88356cd9e3717fd8a3

    SHA512

    1744fcece1a88d7d4ca986f43e3ed76f57306643c1adb55a7fcb0acd1d18ea45a01bd53d267501d6dfde0d923447b9dbc14c87fc0ddfe47621e564012ada3e13

  • memory/936-67-0x00000000745A0000-0x0000000074B4B000-memory.dmp

    Filesize

    5.7MB

  • memory/936-55-0x00000000745A0000-0x0000000074B4B000-memory.dmp

    Filesize

    5.7MB

  • memory/936-56-0x00000000745A0000-0x0000000074B4B000-memory.dmp

    Filesize

    5.7MB

  • memory/936-54-0x0000000076391000-0x0000000076393000-memory.dmp

    Filesize

    8KB

  • memory/1500-61-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1500-59-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1500-68-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1500-70-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1500-72-0x0000000074590000-0x0000000074B3B000-memory.dmp

    Filesize

    5.7MB

  • memory/1500-63-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1500-58-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1500-77-0x0000000074590000-0x0000000074B3B000-memory.dmp

    Filesize

    5.7MB