Analysis
-
max time kernel
141s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
30-05-2023 01:27
Behavioral task
behavioral1
Sample
18cd15b570283c90ba1969da50f22ab64c0c738cd2b83c668d8c30caafb3c3b3.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
18cd15b570283c90ba1969da50f22ab64c0c738cd2b83c668d8c30caafb3c3b3.exe
Resource
win10v2004-20230220-en
General
-
Target
18cd15b570283c90ba1969da50f22ab64c0c738cd2b83c668d8c30caafb3c3b3.exe
-
Size
3.4MB
-
MD5
5c6140b99ac2bf615198e09df7e20534
-
SHA1
3bc40766cd19ed84f188979f27468adff43317d1
-
SHA256
18cd15b570283c90ba1969da50f22ab64c0c738cd2b83c668d8c30caafb3c3b3
-
SHA512
74058e6aa0187a4977a9428d1d67b5ed8e171adae2171b548032223c11d65a096e933ed7240a7b3dcb452ba873ad8d8ad10919588ca1f8b802770b48b819c250
-
SSDEEP
98304:34MtIRiJ0Z0CMUAn8QpWPO9beeEjewd/e:34MtIY9UnQpWcetCwVe
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
18cd15b570283c90ba1969da50f22ab64c0c738cd2b83c668d8c30caafb3c3b3.exepid process 4264 18cd15b570283c90ba1969da50f22ab64c0c738cd2b83c668d8c30caafb3c3b3.exe 4264 18cd15b570283c90ba1969da50f22ab64c0c738cd2b83c668d8c30caafb3c3b3.exe 4264 18cd15b570283c90ba1969da50f22ab64c0c738cd2b83c668d8c30caafb3c3b3.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
18cd15b570283c90ba1969da50f22ab64c0c738cd2b83c668d8c30caafb3c3b3.exedescription pid process target process PID 4264 wrote to memory of 724 4264 18cd15b570283c90ba1969da50f22ab64c0c738cd2b83c668d8c30caafb3c3b3.exe splwow64.exe PID 4264 wrote to memory of 724 4264 18cd15b570283c90ba1969da50f22ab64c0c738cd2b83c668d8c30caafb3c3b3.exe splwow64.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\18cd15b570283c90ba1969da50f22ab64c0c738cd2b83c668d8c30caafb3c3b3.exe"C:\Users\Admin\AppData\Local\Temp\18cd15b570283c90ba1969da50f22ab64c0c738cd2b83c668d8c30caafb3c3b3.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4264-133-0x0000000000400000-0x0000000001172000-memory.dmpFilesize
13.4MB
-
memory/4264-134-0x0000000000400000-0x0000000001172000-memory.dmpFilesize
13.4MB
-
memory/4264-135-0x0000000000400000-0x0000000001172000-memory.dmpFilesize
13.4MB
-
memory/4264-136-0x0000000000400000-0x0000000001172000-memory.dmpFilesize
13.4MB
-
memory/4264-137-0x0000000000400000-0x0000000001172000-memory.dmpFilesize
13.4MB
-
memory/4264-138-0x0000000002EF0000-0x0000000002EF1000-memory.dmpFilesize
4KB
-
memory/4264-139-0x0000000000400000-0x0000000001172000-memory.dmpFilesize
13.4MB
-
memory/4264-140-0x0000000002EF0000-0x0000000002EF1000-memory.dmpFilesize
4KB