Analysis
-
max time kernel
45s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
07-12-2022 12:05
Static task
static1
Behavioral task
behavioral1
Sample
bd811d9e445bb6882d2864faaf80f668.exe
Resource
win7-20220901-en
General
-
Target
bd811d9e445bb6882d2864faaf80f668.exe
-
Size
897KB
-
MD5
bd811d9e445bb6882d2864faaf80f668
-
SHA1
1ee49be423203c7034a6189b0364abfab6e02036
-
SHA256
268552c2ffe8fbb6b8a2244ce2931ca115a4057d74bfb72fc7ba91b95d95ac63
-
SHA512
7f1421afb65de1d60dfe5515a497b9d3c1b4c94f827d85604fa8106c0b69162f4a95463d4dd9c34b1eeb69a55ecdedce175bc938985d5a4b141e6a5b89c202df
-
SSDEEP
12288:x7oQgKZ/nXt7virmWhlGLaQYI1N6kowFheAjRjWf2yS/nhkehKuk5p/kAJF4JzrM:xLvFhecWf2bky0/P45rAQfWeQkNs
Malware Config
Extracted
formbook
w086
F6jSz+l9QmYXguG/xUipf/6ixrik
cQZre8twfBVOOJgLenGTGA==
pG5kW2/wqwEOCVxZ
KORXeYwt7wF8J3BR
HL0ZdBMjeHet
TR57b4Yi6wJ8J3BR
fRyK2yaqeDRGHiQTTw==
RwhsqfRxABNZS59wenGTGA==
GuZaY4H4ahcWKjUdVg==
I5C4/Wyz3fglj+o=
Te5QPEu3NjZ0P58LenGTGA==
M9YJLwifZIi9pfnj2Nj/kA6+ZlU=
c/JFdRndG8f/HiQTTw==
nMmcD1UjeHet
QWR7+9Rh8/l8J3BR
9MD+BzOyI6mXtM4w6LMyEA==
WABgaYPqdJzl2TviGbdH
02OexRebqj3+U2kXhQ0=
j17M2R3/fQwFHiQTTw==
dQpReYss5/l8J3BR
tiaHq71bHDzrXWkXhQ0=
pks7Z4EmPunm2e0ZDK5F
EKYCS50qID/AL4HlVNUIg0XJdFQ=
iCibxeJa5ARNSauNiDOMmBT/
yZHHww7dJM8EHiQTTw==
HbLe2y3prvglj+o=
dVJttQWbovglj+o=
PNU9jC3aosZHn/dewVKhOvPC8tWu
flK4vRfTDsWS7U/JQQoNoDI=
SG097d7jZ8zPlv0=
jildmuNaT3ndPI4LenGTGA==
M8cbIW9BjgwJHiQTTw==
nz6k8Ydf0cxaq/c=
tnrjNokIeQz39UHiGbdH
GJD0UP/vY3uw
yE6h6o1UGTvtXWkXhQ0=
LtxFZHfxbgn95SwTWAE2Sml55w==
rJ2BASXOQZ/Hnw==
7IXl+gV8iRTfWq7mqBU=
fRpdr0gmrlN8J3BR
Pe1BOFsjeHet
VhhdBl9AL2ez
agpovx6sPPHsyhwQDvlqRWRq4A==
2HDY8QKAKT24N46HenGTGA==
KdZAoDfxvDAtDWtZ
6sJYfcmQ43FZM4Z1q3PJcaiOi0CeDw==
khBpyO0KjDxJHiQTTw==
GPZiV8d80sX++1k7R9cn58qr6A==
+sdAldR8R5jdtM4w6LMyEA==
kjRknj/6LMB070Q9NlSVDw==
7oz0SZRADjdrUaqax7S2ozCm8k+qEg==
u4LngJ/1QZ/Hnw==
rSJUnvl4giPmirwliAM7vzo=
0kSk9EsjeHet
zl6gy9h22Hx+b9TVwlbTnM6YviaYRp/FYg==
/qn8dVEjeHet
BpH1R+W9RkuBYriychlArMmp6g==
HOdOcL1wtVIbfN5E8woNoDI=
41rBwtJN2Nt4/V3DNgoNoDI=
5HGl16E9+wV8J3BR
IMUfc0PAT1eIa8e1ojuMmBT/
JM4jYwHVU/0C3y8ZDvlqRWRq4A==
1WfCyxTOQZ/Hnw==
gRRmp/tz4nFcN4BwenGTGA==
re-curve.tech
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
bd811d9e445bb6882d2864faaf80f668.exedescription pid process target process PID 1048 set thread context of 620 1048 bd811d9e445bb6882d2864faaf80f668.exe bd811d9e445bb6882d2864faaf80f668.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
bd811d9e445bb6882d2864faaf80f668.exepid process 620 bd811d9e445bb6882d2864faaf80f668.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
bd811d9e445bb6882d2864faaf80f668.exedescription pid process target process PID 1048 wrote to memory of 620 1048 bd811d9e445bb6882d2864faaf80f668.exe bd811d9e445bb6882d2864faaf80f668.exe PID 1048 wrote to memory of 620 1048 bd811d9e445bb6882d2864faaf80f668.exe bd811d9e445bb6882d2864faaf80f668.exe PID 1048 wrote to memory of 620 1048 bd811d9e445bb6882d2864faaf80f668.exe bd811d9e445bb6882d2864faaf80f668.exe PID 1048 wrote to memory of 620 1048 bd811d9e445bb6882d2864faaf80f668.exe bd811d9e445bb6882d2864faaf80f668.exe PID 1048 wrote to memory of 620 1048 bd811d9e445bb6882d2864faaf80f668.exe bd811d9e445bb6882d2864faaf80f668.exe PID 1048 wrote to memory of 620 1048 bd811d9e445bb6882d2864faaf80f668.exe bd811d9e445bb6882d2864faaf80f668.exe PID 1048 wrote to memory of 620 1048 bd811d9e445bb6882d2864faaf80f668.exe bd811d9e445bb6882d2864faaf80f668.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd811d9e445bb6882d2864faaf80f668.exe"C:\Users\Admin\AppData\Local\Temp\bd811d9e445bb6882d2864faaf80f668.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bd811d9e445bb6882d2864faaf80f668.exe"C:\Users\Admin\AppData\Local\Temp\bd811d9e445bb6882d2864faaf80f668.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/620-64-0x00000000004012B0-mapping.dmp
-
memory/620-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/620-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/620-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/620-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/620-67-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/620-68-0x00000000009C0000-0x0000000000CC3000-memory.dmpFilesize
3.0MB
-
memory/1048-55-0x00000000759F1000-0x00000000759F3000-memory.dmpFilesize
8KB
-
memory/1048-56-0x0000000000850000-0x0000000000866000-memory.dmpFilesize
88KB
-
memory/1048-57-0x0000000000860000-0x000000000086E000-memory.dmpFilesize
56KB
-
memory/1048-58-0x0000000007E70000-0x0000000007F0A000-memory.dmpFilesize
616KB
-
memory/1048-59-0x0000000005D80000-0x0000000005DE0000-memory.dmpFilesize
384KB
-
memory/1048-54-0x0000000000EC0000-0x0000000000FA6000-memory.dmpFilesize
920KB