fb8fdb08cf7984a3bac0cc7daeea3790a92306467543cf556945fc479a165dd8

Analysis

max time kernel
91s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2023, 14:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
S O A -474-84RNEHDR8.exe
Size 884KB
Sample230126-rwvlsaea45
SHA256 fb8fdb08cf7984a3bac0cc7daeea3790a92306467543cf556945fc479a165dd8
MD5 1a9fc43e49a403d8ebec004626492384
SHA1 4b99953586f19060824c491dabea6ef8ab329188
SHA512 9df44c05ee4c3103b3751704f8a37a3f167bc30aba7ba023062e8cb1b9c6e807a4e5976d173f529dd23451d2f6c794078473554fa4f5042bede9c907d0d5e647
SSDEEP 6144:8Np9UX3HMi9Z5xd94cDy5LooPuYANPcTIDsGYXvWRtq8816SjG2B0xisBdwt99pb:pX7RYY4ogsBCt90tr8BQ8mYEAB1
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 376 set thread context of 2064	376	S O A -474-84RNEHDR8.exe	94

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
376	S O A -474-84RNEHDR8.exe
376	S O A -474-84RNEHDR8.exe
376	S O A -474-84RNEHDR8.exe
376	S O A -474-84RNEHDR8.exe
376	S O A -474-84RNEHDR8.exe
376	S O A -474-84RNEHDR8.exe
376	S O A -474-84RNEHDR8.exe
376	S O A -474-84RNEHDR8.exe
376	S O A -474-84RNEHDR8.exe
376	S O A -474-84RNEHDR8.exe
376	S O A -474-84RNEHDR8.exe
376	S O A -474-84RNEHDR8.exe
376	S O A -474-84RNEHDR8.exe
376	S O A -474-84RNEHDR8.exe
376	S O A -474-84RNEHDR8.exe
376	S O A -474-84RNEHDR8.exe
376	S O A -474-84RNEHDR8.exe
376	S O A -474-84RNEHDR8.exe
376	S O A -474-84RNEHDR8.exe
376	S O A -474-84RNEHDR8.exe
376	S O A -474-84RNEHDR8.exe
376	S O A -474-84RNEHDR8.exe
376	S O A -474-84RNEHDR8.exe
376	S O A -474-84RNEHDR8.exe
376	S O A -474-84RNEHDR8.exe
376	S O A -474-84RNEHDR8.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	376	S O A -474-84RNEHDR8.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 376 wrote to memory of 1940	376	S O A -474-84RNEHDR8.exe	81
PID 376 wrote to memory of 1940	376	S O A -474-84RNEHDR8.exe	81
PID 376 wrote to memory of 3540	376	S O A -474-84RNEHDR8.exe	82
PID 376 wrote to memory of 3540	376	S O A -474-84RNEHDR8.exe	82
PID 376 wrote to memory of 4388	376	S O A -474-84RNEHDR8.exe	83
PID 376 wrote to memory of 4388	376	S O A -474-84RNEHDR8.exe	83
PID 376 wrote to memory of 1824	376	S O A -474-84RNEHDR8.exe	84
PID 376 wrote to memory of 1824	376	S O A -474-84RNEHDR8.exe	84
PID 376 wrote to memory of 1828	376	S O A -474-84RNEHDR8.exe	85
PID 376 wrote to memory of 1828	376	S O A -474-84RNEHDR8.exe	85
PID 376 wrote to memory of 2516	376	S O A -474-84RNEHDR8.exe	86
PID 376 wrote to memory of 2516	376	S O A -474-84RNEHDR8.exe	86
PID 376 wrote to memory of 2224	376	S O A -474-84RNEHDR8.exe	87
PID 376 wrote to memory of 2224	376	S O A -474-84RNEHDR8.exe	87
PID 376 wrote to memory of 1740	376	S O A -474-84RNEHDR8.exe	88
PID 376 wrote to memory of 1740	376	S O A -474-84RNEHDR8.exe	88
PID 376 wrote to memory of 1328	376	S O A -474-84RNEHDR8.exe	89
PID 376 wrote to memory of 1328	376	S O A -474-84RNEHDR8.exe	89
PID 376 wrote to memory of 2168	376	S O A -474-84RNEHDR8.exe	90
PID 376 wrote to memory of 2168	376	S O A -474-84RNEHDR8.exe	90
PID 376 wrote to memory of 2692	376	S O A -474-84RNEHDR8.exe	91
PID 376 wrote to memory of 2692	376	S O A -474-84RNEHDR8.exe	91
PID 376 wrote to memory of 2036	376	S O A -474-84RNEHDR8.exe	92
PID 376 wrote to memory of 2036	376	S O A -474-84RNEHDR8.exe	92
PID 376 wrote to memory of 1952	376	S O A -474-84RNEHDR8.exe	93
PID 376 wrote to memory of 1952	376	S O A -474-84RNEHDR8.exe	93
PID 376 wrote to memory of 2064	376	S O A -474-84RNEHDR8.exe	94
PID 376 wrote to memory of 2064	376	S O A -474-84RNEHDR8.exe	94
PID 376 wrote to memory of 2064	376	S O A -474-84RNEHDR8.exe	94
PID 376 wrote to memory of 2064	376	S O A -474-84RNEHDR8.exe	94
PID 376 wrote to memory of 2064	376	S O A -474-84RNEHDR8.exe	94
PID 376 wrote to memory of 2064	376	S O A -474-84RNEHDR8.exe	94
PID 376 wrote to memory of 2064	376	S O A -474-84RNEHDR8.exe	94
PID 376 wrote to memory of 2064	376	S O A -474-84RNEHDR8.exe	94
PID 376 wrote to memory of 2064	376	S O A -474-84RNEHDR8.exe	94

C:\Users\Admin\AppData\Local\Temp\S O A -474-84RNEHDR8.exe
"C:\Users\Admin\AppData\Local\Temp\S O A -474-84RNEHDR8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:376
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"
  2⤵
  PID:1940
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"
  2⤵
  PID:3540
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:4388
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"
  2⤵
  PID:1824
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"
  2⤵
  PID:1828
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"
  2⤵
  PID:2516
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"
  2⤵
  PID:2224
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:1740
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"
  2⤵
  PID:1328
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  PID:2168
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:2692
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
  2⤵
  PID:2036
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1952
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
  2⤵
  PID:2064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/376-132-0x000001EED2880000-0x000001EED2962000-memory.dmp

Download

memory/376-133-0x00007FFDA47E0000-0x00007FFDA52A1000-memory.dmp

Download

memory/376-137-0x00007FFDA47E0000-0x00007FFDA52A1000-memory.dmp

Download

memory/2064-134-0x0000000000400000-0x000000000046A000-memory.dmp

Download

memory/2064-138-0x0000000000400000-0x000000000046A000-memory.dmp

Download

memory/2064-139-0x0000000000400000-0x000000000046A000-memory.dmp

Download