Analysis
-
max time kernel
73s -
max time network
78s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
08-12-2022 02:26
Static task
static1
General
-
Target
dc99d626b36e12c70bcb745c3b7894eda7d7d7c788978eb5ba17beca18e995ab.exe
-
Size
939KB
-
MD5
d85362ebed4b1ec73421fcad1b1ad03d
-
SHA1
70ec5402777057c0ac6cab40698380812341e325
-
SHA256
dc99d626b36e12c70bcb745c3b7894eda7d7d7c788978eb5ba17beca18e995ab
-
SHA512
df86d90a862061cf0bea7f8afa75d251be726e6326d778aa52f6e41d322238bf1341d116aa13e878d33603fc2a34d67000b11372c4cc35bd536b3b99e99c4a0c
-
SSDEEP
12288:ccr2iNUY4IWGjCRqCLg883vVB6l+Gjg34eYJPLByqzNMP1gURVrDJnR6haKnlUvV:3r1ONGjU3LgT//m9jgoeiLBI
Malware Config
Extracted
formbook
w086
F6jSz+l9QmYXguG/xUipf/6ixrik
cQZre8twfBVOOJgLenGTGA==
pG5kW2/wqwEOCVxZ
KORXeYwt7wF8J3BR
HL0ZdBMjeHet
TR57b4Yi6wJ8J3BR
fRyK2yaqeDRGHiQTTw==
RwhsqfRxABNZS59wenGTGA==
GuZaY4H4ahcWKjUdVg==
I5C4/Wyz3fglj+o=
Te5QPEu3NjZ0P58LenGTGA==
M9YJLwifZIi9pfnj2Nj/kA6+ZlU=
c/JFdRndG8f/HiQTTw==
nMmcD1UjeHet
QWR7+9Rh8/l8J3BR
9MD+BzOyI6mXtM4w6LMyEA==
WABgaYPqdJzl2TviGbdH
02OexRebqj3+U2kXhQ0=
j17M2R3/fQwFHiQTTw==
dQpReYss5/l8J3BR
tiaHq71bHDzrXWkXhQ0=
pks7Z4EmPunm2e0ZDK5F
EKYCS50qID/AL4HlVNUIg0XJdFQ=
iCibxeJa5ARNSauNiDOMmBT/
yZHHww7dJM8EHiQTTw==
HbLe2y3prvglj+o=
dVJttQWbovglj+o=
PNU9jC3aosZHn/dewVKhOvPC8tWu
flK4vRfTDsWS7U/JQQoNoDI=
SG097d7jZ8zPlv0=
jildmuNaT3ndPI4LenGTGA==
M8cbIW9BjgwJHiQTTw==
nz6k8Ydf0cxaq/c=
tnrjNokIeQz39UHiGbdH
GJD0UP/vY3uw
yE6h6o1UGTvtXWkXhQ0=
LtxFZHfxbgn95SwTWAE2Sml55w==
rJ2BASXOQZ/Hnw==
7IXl+gV8iRTfWq7mqBU=
fRpdr0gmrlN8J3BR
Pe1BOFsjeHet
VhhdBl9AL2ez
agpovx6sPPHsyhwQDvlqRWRq4A==
2HDY8QKAKT24N46HenGTGA==
KdZAoDfxvDAtDWtZ
6sJYfcmQ43FZM4Z1q3PJcaiOi0CeDw==
khBpyO0KjDxJHiQTTw==
GPZiV8d80sX++1k7R9cn58qr6A==
+sdAldR8R5jdtM4w6LMyEA==
kjRknj/6LMB070Q9NlSVDw==
7oz0SZRADjdrUaqax7S2ozCm8k+qEg==
u4LngJ/1QZ/Hnw==
rSJUnvl4giPmirwliAM7vzo=
0kSk9EsjeHet
zl6gy9h22Hx+b9TVwlbTnM6YviaYRp/FYg==
/qn8dVEjeHet
BpH1R+W9RkuBYriychlArMmp6g==
HOdOcL1wtVIbfN5E8woNoDI=
41rBwtJN2Nt4/V3DNgoNoDI=
5HGl16E9+wV8J3BR
IMUfc0PAT1eIa8e1ojuMmBT/
JM4jYwHVU/0C3y8ZDvlqRWRq4A==
1WfCyxTOQZ/Hnw==
gRRmp/tz4nFcN4BwenGTGA==
re-curve.tech
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
dc99d626b36e12c70bcb745c3b7894eda7d7d7c788978eb5ba17beca18e995ab.exedescription pid process target process PID 2744 set thread context of 3872 2744 dc99d626b36e12c70bcb745c3b7894eda7d7d7c788978eb5ba17beca18e995ab.exe dc99d626b36e12c70bcb745c3b7894eda7d7d7c788978eb5ba17beca18e995ab.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
dc99d626b36e12c70bcb745c3b7894eda7d7d7c788978eb5ba17beca18e995ab.exepid process 3872 dc99d626b36e12c70bcb745c3b7894eda7d7d7c788978eb5ba17beca18e995ab.exe 3872 dc99d626b36e12c70bcb745c3b7894eda7d7d7c788978eb5ba17beca18e995ab.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
dc99d626b36e12c70bcb745c3b7894eda7d7d7c788978eb5ba17beca18e995ab.exedescription pid process target process PID 2744 wrote to memory of 3872 2744 dc99d626b36e12c70bcb745c3b7894eda7d7d7c788978eb5ba17beca18e995ab.exe dc99d626b36e12c70bcb745c3b7894eda7d7d7c788978eb5ba17beca18e995ab.exe PID 2744 wrote to memory of 3872 2744 dc99d626b36e12c70bcb745c3b7894eda7d7d7c788978eb5ba17beca18e995ab.exe dc99d626b36e12c70bcb745c3b7894eda7d7d7c788978eb5ba17beca18e995ab.exe PID 2744 wrote to memory of 3872 2744 dc99d626b36e12c70bcb745c3b7894eda7d7d7c788978eb5ba17beca18e995ab.exe dc99d626b36e12c70bcb745c3b7894eda7d7d7c788978eb5ba17beca18e995ab.exe PID 2744 wrote to memory of 3872 2744 dc99d626b36e12c70bcb745c3b7894eda7d7d7c788978eb5ba17beca18e995ab.exe dc99d626b36e12c70bcb745c3b7894eda7d7d7c788978eb5ba17beca18e995ab.exe PID 2744 wrote to memory of 3872 2744 dc99d626b36e12c70bcb745c3b7894eda7d7d7c788978eb5ba17beca18e995ab.exe dc99d626b36e12c70bcb745c3b7894eda7d7d7c788978eb5ba17beca18e995ab.exe PID 2744 wrote to memory of 3872 2744 dc99d626b36e12c70bcb745c3b7894eda7d7d7c788978eb5ba17beca18e995ab.exe dc99d626b36e12c70bcb745c3b7894eda7d7d7c788978eb5ba17beca18e995ab.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc99d626b36e12c70bcb745c3b7894eda7d7d7c788978eb5ba17beca18e995ab.exe"C:\Users\Admin\AppData\Local\Temp\dc99d626b36e12c70bcb745c3b7894eda7d7d7c788978eb5ba17beca18e995ab.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\dc99d626b36e12c70bcb745c3b7894eda7d7d7c788978eb5ba17beca18e995ab.exe"C:\Users\Admin\AppData\Local\Temp\dc99d626b36e12c70bcb745c3b7894eda7d7d7c788978eb5ba17beca18e995ab.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3872
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2744-120-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-121-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-122-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-123-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-124-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-125-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-126-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-127-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-128-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-129-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-130-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-131-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-132-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-133-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-134-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-135-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-136-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-138-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-137-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-139-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-140-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-141-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-142-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-143-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-144-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-145-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-146-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-147-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-148-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-149-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-150-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-151-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-152-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-153-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-154-0x0000000000810000-0x0000000000902000-memory.dmpFilesize
968KB
-
memory/2744-155-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-156-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-157-0x0000000005680000-0x0000000005B7E000-memory.dmpFilesize
5.0MB
-
memory/2744-158-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-159-0x0000000005220000-0x00000000052B2000-memory.dmpFilesize
584KB
-
memory/2744-160-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-161-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-162-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-164-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-165-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-163-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-166-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-167-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-168-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-169-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-170-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-171-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-172-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-173-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-174-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-175-0x0000000005120000-0x000000000512A000-memory.dmpFilesize
40KB
-
memory/2744-176-0x00000000052C0000-0x000000000535C000-memory.dmpFilesize
624KB
-
memory/2744-177-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-178-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-179-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-180-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-181-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-183-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-184-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-182-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2744-185-0x0000000005210000-0x0000000005226000-memory.dmpFilesize
88KB
-
memory/2744-186-0x0000000007680000-0x000000000768E000-memory.dmpFilesize
56KB
-
memory/2744-187-0x0000000007A40000-0x0000000007AC8000-memory.dmpFilesize
544KB
-
memory/2744-188-0x0000000007AD0000-0x0000000007B1E000-memory.dmpFilesize
312KB
-
memory/3872-189-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3872-190-0x00000000004012B0-mapping.dmp
-
memory/3872-191-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/3872-192-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/3872-193-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/3872-197-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3872-198-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/3872-199-0x00000000016B0000-0x00000000019D0000-memory.dmpFilesize
3.1MB