Analysis

  • max time kernel
    157s
  • max time network
    195s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-12-2022 04:59

General

  • Target

    3deadf1cf2074dcf6fd56bad067c1baa176e6ca167c4ae2b5c60b0c966044a9f.exe

  • Size

    411KB

  • MD5

    3313b1f293772f7310980f3b0ef93b90

  • SHA1

    6e63c9cedb3cdfc35478979191a215ac9847afc9

  • SHA256

    3deadf1cf2074dcf6fd56bad067c1baa176e6ca167c4ae2b5c60b0c966044a9f

  • SHA512

    2895fc2a8f9086a6546b960279c8644c21134ae990ba2e6674b35e31c726a5a37d28cfe83928560fe5be5d6330bc83477a8db6e11957178964c842cce8dd8b0f

  • SSDEEP

    6144:9GK72EZbDOtFRJK4KRKivutOgKcIU4KAF7yHh3bM8:9pZbDGpiAHfOE5

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3deadf1cf2074dcf6fd56bad067c1baa176e6ca167c4ae2b5c60b0c966044a9f.exe
    "C:\Users\Admin\AppData\Local\Temp\3deadf1cf2074dcf6fd56bad067c1baa176e6ca167c4ae2b5c60b0c966044a9f.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2180
    • C:\Users\Admin\AppData\Local\Temp\3deadf1cf2074dcf6fd56bad067c1baa176e6ca167c4ae2b5c60b0c966044a9f.exe
      "C:\Users\Admin\AppData\Local\Temp\3deadf1cf2074dcf6fd56bad067c1baa176e6ca167c4ae2b5c60b0c966044a9f.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:536
      • C:\ProgramData\aRiEGO9LZ1\xqfmmgKxZP3.exe
        "C:\ProgramData\aRiEGO9LZ1\xqfmmgKxZP3.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2088
        • C:\ProgramData\aRiEGO9LZ1\xqfmmgKxZP3.exe
          "C:\ProgramData\aRiEGO9LZ1\xqfmmgKxZP3.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:1528
          • C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe
            "C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe" /i:1528
            5⤵
              PID:3284

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\aRiEGO9LZ1\xqfmmgKxZP3.exe

      Filesize

      411KB

      MD5

      3313b1f293772f7310980f3b0ef93b90

      SHA1

      6e63c9cedb3cdfc35478979191a215ac9847afc9

      SHA256

      3deadf1cf2074dcf6fd56bad067c1baa176e6ca167c4ae2b5c60b0c966044a9f

      SHA512

      2895fc2a8f9086a6546b960279c8644c21134ae990ba2e6674b35e31c726a5a37d28cfe83928560fe5be5d6330bc83477a8db6e11957178964c842cce8dd8b0f

    • C:\ProgramData\aRiEGO9LZ1\xqfmmgKxZP3.exe

      Filesize

      411KB

      MD5

      3313b1f293772f7310980f3b0ef93b90

      SHA1

      6e63c9cedb3cdfc35478979191a215ac9847afc9

      SHA256

      3deadf1cf2074dcf6fd56bad067c1baa176e6ca167c4ae2b5c60b0c966044a9f

      SHA512

      2895fc2a8f9086a6546b960279c8644c21134ae990ba2e6674b35e31c726a5a37d28cfe83928560fe5be5d6330bc83477a8db6e11957178964c842cce8dd8b0f

    • C:\ProgramData\aRiEGO9LZ1\xqfmmgKxZP3.exe

      Filesize

      411KB

      MD5

      122950be412044e5d4f9b0ee833b244f

      SHA1

      4118f43ef65de560de2be56e7000518536cfb32f

      SHA256

      b2de47a062f1ec5acfb2253187b7977ec485c7793c638f75fc35036d34d5b6a9

      SHA512

      51d487803a1914d97aad74d1eee3addc8aba0e2354ddeb188b171ea223cf4d85d80cc11528c5a0763208d1e04369472e99b974ac8db5a0fd43b1314b778c6e25

    • C:\ProgramData\aRiEGO9LZ1\xqfmmgKxZP3.exe

      Filesize

      411KB

      MD5

      122950be412044e5d4f9b0ee833b244f

      SHA1

      4118f43ef65de560de2be56e7000518536cfb32f

      SHA256

      b2de47a062f1ec5acfb2253187b7977ec485c7793c638f75fc35036d34d5b6a9

      SHA512

      51d487803a1914d97aad74d1eee3addc8aba0e2354ddeb188b171ea223cf4d85d80cc11528c5a0763208d1e04369472e99b974ac8db5a0fd43b1314b778c6e25

    • C:\ProgramData\aRiEGO9LZ1\xqfmmgKxZP3.exe

      Filesize

      411KB

      MD5

      122950be412044e5d4f9b0ee833b244f

      SHA1

      4118f43ef65de560de2be56e7000518536cfb32f

      SHA256

      b2de47a062f1ec5acfb2253187b7977ec485c7793c638f75fc35036d34d5b6a9

      SHA512

      51d487803a1914d97aad74d1eee3addc8aba0e2354ddeb188b171ea223cf4d85d80cc11528c5a0763208d1e04369472e99b974ac8db5a0fd43b1314b778c6e25

    • C:\Users\Admin\AppData\Local\Temp\edSSgbdRckOz.exe

      Filesize

      411KB

      MD5

      122950be412044e5d4f9b0ee833b244f

      SHA1

      4118f43ef65de560de2be56e7000518536cfb32f

      SHA256

      b2de47a062f1ec5acfb2253187b7977ec485c7793c638f75fc35036d34d5b6a9

      SHA512

      51d487803a1914d97aad74d1eee3addc8aba0e2354ddeb188b171ea223cf4d85d80cc11528c5a0763208d1e04369472e99b974ac8db5a0fd43b1314b778c6e25

    • C:\Users\Admin\AppData\Local\Temp\edSSgbdRckOz.exe

      Filesize

      411KB

      MD5

      122950be412044e5d4f9b0ee833b244f

      SHA1

      4118f43ef65de560de2be56e7000518536cfb32f

      SHA256

      b2de47a062f1ec5acfb2253187b7977ec485c7793c638f75fc35036d34d5b6a9

      SHA512

      51d487803a1914d97aad74d1eee3addc8aba0e2354ddeb188b171ea223cf4d85d80cc11528c5a0763208d1e04369472e99b974ac8db5a0fd43b1314b778c6e25

    • memory/536-136-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/536-135-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/536-133-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/536-134-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/536-142-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/1528-150-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/1528-151-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/1528-157-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/3284-156-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB