aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 10:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe
Size

557KB
MD5

2dc2ec61c9cc6b6e55880952ed063521
SHA1

915ff1c43c20538e51b09fc775fdc5b908091837
SHA256

aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3
SHA512

98f3f16f23c76e42a4247c487e7c6d21f73f158da6928c3a51354c4f8086d05962e55c0a5a6d0de3e079378bb298fc6f010c61b7d127519bab67c5663a0880fc
SSDEEP

6144:KxCIqMUcsrgENAnR14Uyf93PypZ1bxb0Bvc4DWV/b5eR:fIrUcsrgENAnjc90ZbAvJ0MR

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2608-132-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral2/memory/480-136-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral2/memory/480-138-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral2/memory/480-139-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral2/memory/2608-141-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral2/memory/480-146-0x0000000000400000-0x0000000000445000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2608 set thread context of 480	2608	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	80
PID 480 set thread context of 980	480	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	81

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2608	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe
480	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 480	2608	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	80
PID 2608 wrote to memory of 480	2608	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	80
PID 2608 wrote to memory of 480	2608	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	80
PID 2608 wrote to memory of 480	2608	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	80
PID 2608 wrote to memory of 480	2608	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	80
PID 2608 wrote to memory of 480	2608	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	80
PID 2608 wrote to memory of 480	2608	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	80
PID 2608 wrote to memory of 480	2608	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	80
PID 480 wrote to memory of 980	480	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	81
PID 480 wrote to memory of 980	480	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	81
PID 480 wrote to memory of 980	480	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	81
PID 480 wrote to memory of 980	480	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	81
PID 480 wrote to memory of 980	480	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	81
PID 480 wrote to memory of 980	480	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	81
PID 480 wrote to memory of 980	480	aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe	81

C:\Users\Admin\AppData\Local\Temp\aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe
"C:\Users\Admin\AppData\Local\Temp\aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Users\Admin\AppData\Local\Temp\aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe
  "C:\Users\Admin\AppData\Local\Temp\aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:480
- - C:\Users\Admin\AppData\Local\Temp\aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe
    "C:\Users\Admin\AppData\Local\Temp\aa3a910938b4e8a95b79117fc6cd22db599f9a09ed302f6837d597606409fbd3.exe"
    3⤵
    PID:980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/480-136-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/480-138-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/480-139-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/480-146-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/980-144-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/980-147-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/980-148-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2608-132-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2608-141-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download