Analysis

  • max time kernel
    134s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-12-2022 11:36

General

  • Target

    ebc511ed3c477639ee9c6d56506346044f963d6cb713b3c81341add9aa52191c.exe

  • Size

    136KB

  • MD5

    8c4f39320d7c4eea6b3e072106b282bf

  • SHA1

    6ae3da39b56a665c3586099cbac685067d7442b0

  • SHA256

    ebc511ed3c477639ee9c6d56506346044f963d6cb713b3c81341add9aa52191c

  • SHA512

    035b61fca54b05f12de676a66eedce5a9474690a6a6cff29614af94368b8505ff34446967179bd960d2b92bc5a96256f2a1d2fb41e3bdeae80a439287166b8d4

  • SSDEEP

    1536:6MVDsEe+yoBaVzlhNCg6k3j5kgOXUq+rtQ/QQkAT9TmY+R6rk3qZOPf:rplyoBaVphV6AtkgOXUqaaF9Tmb6yf

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ebc511ed3c477639ee9c6d56506346044f963d6cb713b3c81341add9aa52191c.exe
    "C:\Users\Admin\AppData\Local\Temp\ebc511ed3c477639ee9c6d56506346044f963d6cb713b3c81341add9aa52191c.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3108
    • C:\Users\Admin\AppData\Local\Temp\ebc511ed3c477639ee9c6d56506346044f963d6cb713b3c81341add9aa52191c.exe
      C:\Users\Admin\AppData\Local\Temp\ebc511ed3c477639ee9c6d56506346044f963d6cb713b3c81341add9aa52191c.exe
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1604
      • C:\Users\Admin\AppData\Roaming\taskhost.exe
        C:\Users\Admin\AppData\Roaming\taskhost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4796
        • C:\Users\Admin\AppData\Roaming\taskhost.exe
          C:\Users\Admin\AppData\Roaming\taskhost.exe
          4⤵
          • Executes dropped EXE
          PID:792
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 292
          4⤵
          • Program crash
          PID:1812
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 304
      2⤵
      • Program crash
      PID:2432
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3108 -ip 3108
    1⤵
      PID:4844
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4796 -ip 4796
      1⤵
        PID:1524

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\taskhost.exe

        Filesize

        136KB

        MD5

        685c988850fc65706157bded578b507e

        SHA1

        8f1a6e53de157915cc30732c96c213589713d0ed

        SHA256

        c77feefdfc67f4a0488ef58b774e2d8814d5bdfa8c215e82b8991807d712c90c

        SHA512

        ed8bb993a5788eb545bf6cb99981bed3739885f16e95495784d066cb59273012a1aaef072516084290aedbd4c4dc77d86803fd7d68c8dbacc98f308fc0a7292e

      • C:\Users\Admin\AppData\Roaming\taskhost.exe

        Filesize

        136KB

        MD5

        685c988850fc65706157bded578b507e

        SHA1

        8f1a6e53de157915cc30732c96c213589713d0ed

        SHA256

        c77feefdfc67f4a0488ef58b774e2d8814d5bdfa8c215e82b8991807d712c90c

        SHA512

        ed8bb993a5788eb545bf6cb99981bed3739885f16e95495784d066cb59273012a1aaef072516084290aedbd4c4dc77d86803fd7d68c8dbacc98f308fc0a7292e

      • C:\Users\Admin\AppData\Roaming\taskhost.exe

        Filesize

        136KB

        MD5

        685c988850fc65706157bded578b507e

        SHA1

        8f1a6e53de157915cc30732c96c213589713d0ed

        SHA256

        c77feefdfc67f4a0488ef58b774e2d8814d5bdfa8c215e82b8991807d712c90c

        SHA512

        ed8bb993a5788eb545bf6cb99981bed3739885f16e95495784d066cb59273012a1aaef072516084290aedbd4c4dc77d86803fd7d68c8dbacc98f308fc0a7292e

      • memory/792-142-0x0000000000400000-0x000000000042A000-memory.dmp

        Filesize

        168KB

      • memory/792-139-0x0000000000000000-mapping.dmp

      • memory/792-143-0x0000000000400000-0x000000000042A000-memory.dmp

        Filesize

        168KB

      • memory/792-145-0x0000000000400000-0x000000000042A000-memory.dmp

        Filesize

        168KB

      • memory/1604-135-0x0000000000400000-0x000000000042A000-memory.dmp

        Filesize

        168KB

      • memory/1604-134-0x0000000000400000-0x000000000042A000-memory.dmp

        Filesize

        168KB

      • memory/1604-133-0x0000000000400000-0x000000000042A000-memory.dmp

        Filesize

        168KB

      • memory/1604-132-0x0000000000000000-mapping.dmp

      • memory/1604-144-0x0000000000400000-0x000000000042A000-memory.dmp

        Filesize

        168KB

      • memory/4796-136-0x0000000000000000-mapping.dmp