Analysis
-
max time kernel
64s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
08-12-2022 11:06
Static task
static1
Behavioral task
behavioral1
Sample
3f208f220000f38395c96a06011496d755e7f4932a037ac08f884dbe81462a0e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3f208f220000f38395c96a06011496d755e7f4932a037ac08f884dbe81462a0e.exe
Resource
win10v2004-20221111-en
General
-
Target
3f208f220000f38395c96a06011496d755e7f4932a037ac08f884dbe81462a0e.exe
-
Size
1.0MB
-
MD5
6be4ed58ccaac533af70b264d7132bac
-
SHA1
0084169c3f9e4acef3917f29873f81d7474bcd82
-
SHA256
3f208f220000f38395c96a06011496d755e7f4932a037ac08f884dbe81462a0e
-
SHA512
4e51bca0bd135f3800371481121c439b3a138fb90e70f7a50b66811940199e34f35cddabaff64fcacab5c45d9544844bd34eb4e29c8fce72bbd7bc8bec4c6743
-
SSDEEP
12288:rXWgh/PsZ1DX/VDJIhp+dTjmuYqfaIGU0MgXo5BASa37dI6R82HOC7:rWgh/P9h2ugJhLASaW6R82HOs
Malware Config
Extracted
formbook
wu27
69/AbbgufRx7loCQ5G4WYQ==
uydiDFvHsFxlIrdq
NBlmCe8ii+DEa2ye5G4WYQ==
LicGnHCl/UZ2UMg=
e2lQ8e1lsXvAeX+U5G4WYQ==
2bF/M54rOGusdYqc5G4WYQ==
mQLidD9i82JIsrqysw==
ZdlDYrcsl/L9eH+U5G4WYQ==
80ucyjCJdqXkcNI=
/eg6aKbVvNkwOcxzZyAx3cCTN5E=
lflaF0MvE+fHXoWmrg==
qRfykIXbxMkND1kwe3I=
s6iSNSVOMwnpvFDxdFLlOfqBMw==
imkLObSlIdc=
oBUBm36yNaZ99JYxenA=
ngFE7+IP8Te6N75o
O6Htl8Oyjb0Msrqysw==
f4JgCEnC0LEC9w==
9+dNeq/hVxaAhxzT1pbgzZ2mb3Nf
980jQpYF3y1wMomLfWU=
S7CXLmSvnae6N75o
LBsMM7E1hfqVbco=
SEmi10GnjKIC6T/PG9vpot2mb3Nf
6N2zXagR4zO6N75o
Y0MbsfJvYcM0QFR/yF43rH/WOQ==
4FvE6St/5VeaknSQ5G4WYQ==
FfvsmYGmgr8mMUN2yF43rH/WOQ==
sZeFLWrFrbutSaQ7S92VaLlsEdqDAw==
GAtfhcHou9EYD1kwe3I=
K5TzEFu9HopZDGwZK5fekyc=
yhtuD9/zPeh7cNJ1
oBFUB0rNZ9UJtoKh5G4WYQ==
htsvVpfFs/hvRmJrdiz3aQ==
zkURs/JLt1O2s3+Q5G4WYQ==
YtItQ4f8Z8uWQVkwe3I=
TKgCIWWoGbgHsrqysw==
IY19JVOJgLkbJzhgayaKol308Bm3Hg==
EI3wCpvRR9Yg0e0RXTvsJdqoIZ6NfxeeCw==
dcaSQpkcgvqVbco=
i3LR8zl6Q4ES1Li7uw==
zU2iXqctzPaGh2+K08GQzt13MQ==
+vNEAOcjj/qVbco=
n4PyGmPPxsmoGkJ5gyJ4
42JPceRLN2LLp/J9fBwczl9uB5ohvsI=
hQDekPl/6Eob4PLRVmo=
tCZ5ldT9DNUX/Q==
zLGkPk9ZW5hNJgT+VMBIfWsw
8eEl1y6bl8w4HwYQYlOgnwOCqYM110TkHA==
y63rGlN+VWFNIAS/UTZw
TCdmmNUE3f1fPFkwe3I=
zjF2JXfZpoNK+dsaJtaSBcCTN5E=
DOA6audAeWU5
E+5C9MobExoL3MzxRz6+zt13MQ==
uK35B1bZy62abf1z7dVKfA==
avJCc7T0V9MKsrqysw==
ugpaFO0zNWfJpn1rt38fYw==
1MGtUYv0v/dkdYCn5G4WYQ==
KZT2GIMGUw9EBHgva09Hf2Ux
GhNjEWToYe7ddkhnsYtIv3Lz8Bm3Hg==
zi1OxCCLk1bvzK7OEZud3sJ9Jg==
WU0txI+4FsP7kfGNm0tHf2Ux
hmdH59P8VKbSjdc=
x7oPsXu0jYXBsfiIyMIyWwuUuR4tEQ==
EG3AXyZo4XFZsrqysw==
cailiotweet.store
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
3f208f220000f38395c96a06011496d755e7f4932a037ac08f884dbe81462a0e.exedescription pid process target process PID 584 set thread context of 960 584 3f208f220000f38395c96a06011496d755e7f4932a037ac08f884dbe81462a0e.exe 3f208f220000f38395c96a06011496d755e7f4932a037ac08f884dbe81462a0e.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
3f208f220000f38395c96a06011496d755e7f4932a037ac08f884dbe81462a0e.exepid process 960 3f208f220000f38395c96a06011496d755e7f4932a037ac08f884dbe81462a0e.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
3f208f220000f38395c96a06011496d755e7f4932a037ac08f884dbe81462a0e.exedescription pid process target process PID 584 wrote to memory of 960 584 3f208f220000f38395c96a06011496d755e7f4932a037ac08f884dbe81462a0e.exe 3f208f220000f38395c96a06011496d755e7f4932a037ac08f884dbe81462a0e.exe PID 584 wrote to memory of 960 584 3f208f220000f38395c96a06011496d755e7f4932a037ac08f884dbe81462a0e.exe 3f208f220000f38395c96a06011496d755e7f4932a037ac08f884dbe81462a0e.exe PID 584 wrote to memory of 960 584 3f208f220000f38395c96a06011496d755e7f4932a037ac08f884dbe81462a0e.exe 3f208f220000f38395c96a06011496d755e7f4932a037ac08f884dbe81462a0e.exe PID 584 wrote to memory of 960 584 3f208f220000f38395c96a06011496d755e7f4932a037ac08f884dbe81462a0e.exe 3f208f220000f38395c96a06011496d755e7f4932a037ac08f884dbe81462a0e.exe PID 584 wrote to memory of 960 584 3f208f220000f38395c96a06011496d755e7f4932a037ac08f884dbe81462a0e.exe 3f208f220000f38395c96a06011496d755e7f4932a037ac08f884dbe81462a0e.exe PID 584 wrote to memory of 960 584 3f208f220000f38395c96a06011496d755e7f4932a037ac08f884dbe81462a0e.exe 3f208f220000f38395c96a06011496d755e7f4932a037ac08f884dbe81462a0e.exe PID 584 wrote to memory of 960 584 3f208f220000f38395c96a06011496d755e7f4932a037ac08f884dbe81462a0e.exe 3f208f220000f38395c96a06011496d755e7f4932a037ac08f884dbe81462a0e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f208f220000f38395c96a06011496d755e7f4932a037ac08f884dbe81462a0e.exe"C:\Users\Admin\AppData\Local\Temp\3f208f220000f38395c96a06011496d755e7f4932a037ac08f884dbe81462a0e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Users\Admin\AppData\Local\Temp\3f208f220000f38395c96a06011496d755e7f4932a037ac08f884dbe81462a0e.exe"C:\Users\Admin\AppData\Local\Temp\3f208f220000f38395c96a06011496d755e7f4932a037ac08f884dbe81462a0e.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:960
-