Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
05-12-2022 00:54
Static task
static1
Behavioral task
behavioral1
Sample
2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe
Resource
win7-20220812-en
General
-
Target
2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe
-
Size
996KB
-
MD5
a4b95505ac0ea4f9e62da770bf60a2f8
-
SHA1
e30412924fc260ce5842730d8f7808c5eb58471f
-
SHA256
2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644
-
SHA512
56fc357e3529aa97f79f534daf843607dad29171a7d8318eabee5889329249b45dcb98d787f61712e220cada3e1f8872bb4b1ec25bc094796032551c0329e90f
-
SSDEEP
12288:I6wgh/cS0Rt2UnIUCsJ1hmuaB73bdgjcedXtcSEjz5ktYnxWzgRVDqlq9cVrbF:INgh/f2t/nVp1A73Bgjc8tcf5ktYn04
Malware Config
Extracted
formbook
b5jr
0de6wt9fDj2VzxFqyWStU2IZ
CEIlhC3/D4QckHwMOdQ=
324+OHk+LFMruPQ9L80=
052Bh/ajSEHVHMVOuQkQ
9DfC8AWAPlfh8P8=
+4Zqgb98ctfC/sT1EK31+8i9zyQ=
fkISYqdAD/gETU1glGl6ow==
muKtqNNZLlfh8P8=
qXtWc7RyEEJcdPkP
uL6XqPW6YUKi4UGNsQ==
iQT57xCknBF0qdAtV/Q88sRX8LzWzoSk
ZzYKFzTOjad8wuY=
D8Va1XR/BkMvcAxaQpofB6Og+yaT
IP7S065oQrQ/yA==
aEIWMUXk4hdw+ClvnoUBL8i9zyQ=
bjoiiSUS4sjYJPQ9L80=
+8Sk90TLmX4nbfdOuQkQ
ukEMGzCnXT/FIMz2n7T8lHIT
JzDsQuW6h3T9UQgzlGl6ow==
ugPgPem5vCmtvzE9q9bIOMN7ow==
qrKKkgGwTjYdsvQ9L80=
odywrM9tdNptAzhdlGl6ow==
XmTDRGIowKk=
aXJNTWUF3wOhHaK/bsU=
vIlgpkkw5hZuxu9Her0NPuOF7joxPQ==
pjkWbg/i/mJGjCAWAQsfdu2YrDwwNQ==
s31sbIEIn4NZ12GBIUNN5+OG7joxPQ==
5v3b6QCKUoXT4UGNsQ==
e0YNTOnOirwQR1lsZ62778i9zyQ=
1B7wNYYG50v1ea/JrcPF78i9zyQ=
tjUPNxLcquO5BroH
PQri3fOYnvvVH7Tci9gfeWMR
exT2BnlNFgJbbQ1Fut0feWMR
Xdy1pMM5J5DeGvQ9L80=
L8ijl7ZKFFAuePxmyWauvg==
8fTSB5BDOGInLvQ9L80=
m2g9MlPddV11vtP0o7A+UWU=
/cm4E62JVkgmMPQ9L80=
5Oyy/odlLVofahJmW7A+UWU=
tTr5QNejfVKv4UGNsQ==
aySGCeZoHEJcdPkP
vb1drkMc3guf0HbUfdAfeWMR
miL28jDu2jxV8Hhkx9wfeWMR
jQuerwkFthBjrOY=
NsOYyTyKFcZZ1g==
VywOZgW/V4znQnuRduQfeWMR
nzIFClVWv7CImnwMOdQ=
aGtMhyDay/O5zOgQudwfeWMR
ECDsRbYj2r+VrNz59TdXz6RP2d5+4X6z
StXFCUXl5lfh8P8=
8otIo7h7JPGe
2ua56FFQ+dqHyzyQqQ==
m9ewo6lJFcZZ1g==
MS3V6BXnbqSJ
Hppzf5I47uf/PTraDR4svWM=
voRWrfWaZQtjrOY=
VJmBiq5NFcZZ1g==
vsO4Aq5aCuh1sUg5TbA+UWU=
hAfu8NrJ/Vfh8P8=
cnpPhJVyP1fh8P8=
3bBudX8bKponusDZBSojS28gvdN+4X6z
VivzAVYiwq9QiLPOuQ==
6fbYC5BAN2g3tGTC6P8J
gH9srj0j8NrX4UGNsQ==
mushterinn.com
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exedescription pid process target process PID 816 set thread context of 3044 816 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exepid process 816 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe 816 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe 3044 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe 3044 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exedescription pid process Token: SeDebugPrivilege 816 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exedescription pid process target process PID 816 wrote to memory of 4876 816 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe PID 816 wrote to memory of 4876 816 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe PID 816 wrote to memory of 4876 816 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe PID 816 wrote to memory of 3044 816 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe PID 816 wrote to memory of 3044 816 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe PID 816 wrote to memory of 3044 816 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe PID 816 wrote to memory of 3044 816 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe PID 816 wrote to memory of 3044 816 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe PID 816 wrote to memory of 3044 816 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe 2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe"C:\Users\Admin\AppData\Local\Temp\2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe"C:\Users\Admin\AppData\Local\Temp\2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe"2⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe"C:\Users\Admin\AppData\Local\Temp\2c412d963b9d1020bea10e91d8aa14a58b950e3b85c1dbc13be4301c468bd644.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3044
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/816-132-0x0000000000120000-0x0000000000220000-memory.dmpFilesize
1024KB
-
memory/816-133-0x00000000051E0000-0x0000000005784000-memory.dmpFilesize
5.6MB
-
memory/816-134-0x0000000004C30000-0x0000000004CC2000-memory.dmpFilesize
584KB
-
memory/816-135-0x0000000004BB0000-0x0000000004BBA000-memory.dmpFilesize
40KB
-
memory/816-136-0x0000000008A20000-0x0000000008ABC000-memory.dmpFilesize
624KB
-
memory/3044-138-0x0000000000000000-mapping.dmp
-
memory/3044-139-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3044-141-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3044-142-0x0000000000401000-0x000000000042E000-memory.dmpFilesize
180KB
-
memory/3044-143-0x00000000013E0000-0x000000000172A000-memory.dmpFilesize
3.3MB
-
memory/3044-144-0x00000000013E0000-0x000000000172A000-memory.dmpFilesize
3.3MB
-
memory/4876-137-0x0000000000000000-mapping.dmp