Analysis
-
max time kernel
912s -
max time network
914s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05-12-2022 00:54
Static task
static1
Behavioral task
behavioral1
Sample
2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe
Resource
win7-20220812-en
General
-
Target
2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe
-
Size
996KB
-
MD5
a4b95505ac0ea4f9e62da770bf60a2f8
-
SHA1
e30412924fc260ce5842730d8f7808c5eb58471f
-
SHA256
2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644
-
SHA512
56fc357e3529aa97f79f534daf843607dad29171a7d8318eabee5889329249b45dcb98d787f61712e220cada3e1f8872bb4b1ec25bc094796032551c0329e90f
-
SSDEEP
12288:I6wgh/cS0Rt2UnIUCsJ1hmuaB73bdgjcedXtcSEjz5ktYnxWzgRVDqlq9cVrbF:INgh/f2t/nVp1A73Bgjc8tcf5ktYn04
Malware Config
Extracted
formbook
b5jr
0de6wt9fDj2VzxFqyWStU2IZ
CEIlhC3/D4QckHwMOdQ=
324+OHk+LFMruPQ9L80=
052Bh/ajSEHVHMVOuQkQ
9DfC8AWAPlfh8P8=
+4Zqgb98ctfC/sT1EK31+8i9zyQ=
fkISYqdAD/gETU1glGl6ow==
muKtqNNZLlfh8P8=
qXtWc7RyEEJcdPkP
uL6XqPW6YUKi4UGNsQ==
iQT57xCknBF0qdAtV/Q88sRX8LzWzoSk
ZzYKFzTOjad8wuY=
D8Va1XR/BkMvcAxaQpofB6Og+yaT
IP7S065oQrQ/yA==
aEIWMUXk4hdw+ClvnoUBL8i9zyQ=
bjoiiSUS4sjYJPQ9L80=
+8Sk90TLmX4nbfdOuQkQ
ukEMGzCnXT/FIMz2n7T8lHIT
JzDsQuW6h3T9UQgzlGl6ow==
ugPgPem5vCmtvzE9q9bIOMN7ow==
qrKKkgGwTjYdsvQ9L80=
odywrM9tdNptAzhdlGl6ow==
XmTDRGIowKk=
aXJNTWUF3wOhHaK/bsU=
vIlgpkkw5hZuxu9Her0NPuOF7joxPQ==
pjkWbg/i/mJGjCAWAQsfdu2YrDwwNQ==
s31sbIEIn4NZ12GBIUNN5+OG7joxPQ==
5v3b6QCKUoXT4UGNsQ==
e0YNTOnOirwQR1lsZ62778i9zyQ=
1B7wNYYG50v1ea/JrcPF78i9zyQ=
tjUPNxLcquO5BroH
PQri3fOYnvvVH7Tci9gfeWMR
exT2BnlNFgJbbQ1Fut0feWMR
Xdy1pMM5J5DeGvQ9L80=
L8ijl7ZKFFAuePxmyWauvg==
8fTSB5BDOGInLvQ9L80=
m2g9MlPddV11vtP0o7A+UWU=
/cm4E62JVkgmMPQ9L80=
5Oyy/odlLVofahJmW7A+UWU=
tTr5QNejfVKv4UGNsQ==
aySGCeZoHEJcdPkP
vb1drkMc3guf0HbUfdAfeWMR
miL28jDu2jxV8Hhkx9wfeWMR
jQuerwkFthBjrOY=
NsOYyTyKFcZZ1g==
VywOZgW/V4znQnuRduQfeWMR
nzIFClVWv7CImnwMOdQ=
aGtMhyDay/O5zOgQudwfeWMR
ECDsRbYj2r+VrNz59TdXz6RP2d5+4X6z
StXFCUXl5lfh8P8=
8otIo7h7JPGe
2ua56FFQ+dqHyzyQqQ==
m9ewo6lJFcZZ1g==
MS3V6BXnbqSJ
Hppzf5I47uf/PTraDR4svWM=
voRWrfWaZQtjrOY=
VJmBiq5NFcZZ1g==
vsO4Aq5aCuh1sUg5TbA+UWU=
hAfu8NrJ/Vfh8P8=
cnpPhJVyP1fh8P8=
3bBudX8bKponusDZBSojS28gvdN+4X6z
VivzAVYiwq9QiLPOuQ==
6fbYC5BAN2g3tGTC6P8J
gH9srj0j8NrX4UGNsQ==
mushterinn.com
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exedescription pid process target process PID 1500 set thread context of 1756 1500 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exepid process 1756 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exedescription pid process target process PID 1500 wrote to memory of 1756 1500 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe PID 1500 wrote to memory of 1756 1500 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe PID 1500 wrote to memory of 1756 1500 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe PID 1500 wrote to memory of 1756 1500 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe PID 1500 wrote to memory of 1756 1500 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe PID 1500 wrote to memory of 1756 1500 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe PID 1500 wrote to memory of 1756 1500 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe"C:\Users\Admin\AppData\Local\Temp\2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe"C:\Users\Admin\AppData\Local\Temp\2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1756
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1500-54-0x0000000000DD0000-0x0000000000ED0000-memory.dmpFilesize
1024KB
-
memory/1500-55-0x0000000075B41000-0x0000000075B43000-memory.dmpFilesize
8KB
-
memory/1500-56-0x00000000009C0000-0x00000000009D6000-memory.dmpFilesize
88KB
-
memory/1500-57-0x00000000009D0000-0x00000000009DE000-memory.dmpFilesize
56KB
-
memory/1500-58-0x0000000007D70000-0x0000000007E04000-memory.dmpFilesize
592KB
-
memory/1500-59-0x0000000004EB0000-0x0000000004F0A000-memory.dmpFilesize
360KB
-
memory/1756-60-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1756-61-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1756-64-0x00000000004012B0-mapping.dmp
-
memory/1756-63-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1756-66-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1756-67-0x0000000000401000-0x000000000042E000-memory.dmpFilesize
180KB
-
memory/1756-68-0x0000000000990000-0x0000000000C93000-memory.dmpFilesize
3.0MB