2ab05c870c006127e4b7a4d89ce2867e2d348c169c470eb63bb5168b7e4cf321

Resubmissions

24/07/2023, 19:06

230724-xr3dqage79

24/07/2023, 19:04

08/05/2023, 07:26

28/01/2023, 04:59

28/01/2023, 04:57

28/01/2023, 04:55

18/11/2021, 00:06

17/11/2021, 23:36

Analysis

max time kernel
0s
max time network
25s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2023, 04:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Reading agent response: read tcp 10.127.0.1:37170->10.127.0.143:8000: read: connection timed out

General

Target
1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe
Size 22KB
Sample230128-flhzfseb98
SHA256 1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367
MD5 7906dc475a8ae55ffb5af7fd3ac8f10a
SHA1 e7304e2436dc0eddddba229f1ec7145055030151
SHA512 c087b3107295095e9aca527d02b74c067e96ca5daf5457e465f8606dbf4809027faedf65d77868f6fb8bb91a1438e3d0169e59efddf1439bbd3adb3e23a739a1
SSDEEP 384:otLvArTA5n2Kc/vURgbHs19l897hkuzetFS/z1ANkp2RD0CwMiOQkSd:odvOM5UNMRS7W2AiEd08D
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4904 set thread context of 2344	4904	1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe	18

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4904	1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe
4904	1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4904	1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe
4904	1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2344

C:\Users\Admin\AppData\Local\Temp\1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe
"C:\Users\Admin\AppData\Local\Temp\1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4904

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads