Analysis
-
max time kernel
112s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 04:28
Static task
static1
Behavioral task
behavioral1
Sample
cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.exe
Resource
win10v2004-20220901-en
General
-
Target
cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.exe
-
Size
329KB
-
MD5
34f8df93f01d64536e8dc0f417c8d475
-
SHA1
16e83c0e54980a4668ee76daffe24fa44d97b6a5
-
SHA256
cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc
-
SHA512
7ed3bdf7a3b45cd17d024c50c1d2043199a9a0515eafa424346136826a3f3f18b4cab37b8097601401f50a9238aa938bedb0a7d9642447a7ace37e6387ce5ec8
-
SSDEEP
6144:XZY/eK/Dr1FFr6I1+a0KgiTo/jcPkce5ln98gWNlPTGQQm6agrdr8:JY/VbFrB1nJgiTwjcPHyGNtTirdr8
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.exedescription pid process target process PID 4844 set thread context of 1460 4844 cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.exe cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.exepid process 1460 cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.exe 1460 cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.exe 1460 cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.exe 1460 cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.execf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.exedescription pid process target process PID 4844 wrote to memory of 1460 4844 cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.exe cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.exe PID 4844 wrote to memory of 1460 4844 cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.exe cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.exe PID 4844 wrote to memory of 1460 4844 cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.exe cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.exe PID 4844 wrote to memory of 1460 4844 cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.exe cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.exe PID 4844 wrote to memory of 1460 4844 cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.exe cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.exe PID 4844 wrote to memory of 1460 4844 cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.exe cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.exe PID 4844 wrote to memory of 1460 4844 cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.exe cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.exe PID 1460 wrote to memory of 3048 1460 cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.exe Explorer.EXE PID 1460 wrote to memory of 3048 1460 cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.exe Explorer.EXE PID 1460 wrote to memory of 3048 1460 cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.exe Explorer.EXE PID 1460 wrote to memory of 3048 1460 cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.exe"C:\Users\Admin\AppData\Local\Temp\cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.exeC:\Users\Admin\AppData\Local\Temp\cf8f6f866a7a23395d190204e750675e7802692ebb450ddd0522c4db148fadbc.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1460-134-0x0000000000000000-mapping.dmp
-
memory/1460-135-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1460-136-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1460-140-0x0000000000400000-0x0000000000408960-memory.dmpFilesize
34KB
-
memory/1460-142-0x0000000010000000-0x0000000010013000-memory.dmpFilesize
76KB
-
memory/3048-141-0x000000007FFF0000-0x000000007FFF7000-memory.dmpFilesize
28KB
-
memory/4844-132-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/4844-133-0x00000000006A0000-0x00000000006E3000-memory.dmpFilesize
268KB
-
memory/4844-139-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB