8a93eabf56949eb69dc5c81a39645fec215d967d126751a8bb72e2f90a3c41c7

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2023, 21:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
stubbed.exe
Size 434KB
Sample230809-1bwg1sff58
SHA256 8a93eabf56949eb69dc5c81a39645fec215d967d126751a8bb72e2f90a3c41c7
MD5 32779bb4eda0b1834dc50d88f4930c3e
SHA1 7041fb14c8593d2657d4244d6930a35a2745f96e
SHA512 aeb8e88e9b016df87228be72517694f1c382fde0e1f42bb3e91f0fba22ef8abc7298aec89cb8439d1c1bb20ae2429f1d4bee5a99f9fd78f4a8d7840ca856b0c8
SSDEEP 12288:ObfJmY1oCMa3Wyex7ykWynLSKJ13oqnuj/ro:O7bKCM0ax7ykWynLRJ1Y+uTro
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 17 IoCs

flow	pid	Process
8	1164	cmd.exe
9	1164	cmd.exe
10	1164	cmd.exe
23	1164	cmd.exe
27	1164	cmd.exe
38	1164	cmd.exe
39	1164	cmd.exe
40	1164	cmd.exe
43	1164	cmd.exe
44	1164	cmd.exe
48	1164	cmd.exe
50	1164	cmd.exe
51	1164	cmd.exe
52	1164	cmd.exe
54	1164	cmd.exe
59	1164	cmd.exe
60	1164	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1724 set thread context of 1164	1724	stubbed.exe	82

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1724	stubbed.exe
1724	stubbed.exe
1164	cmd.exe
1164	cmd.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1164	1724	stubbed.exe	82
PID 1724 wrote to memory of 1164	1724	stubbed.exe	82
PID 1724 wrote to memory of 1164	1724	stubbed.exe	82
PID 1724 wrote to memory of 1164	1724	stubbed.exe	82
PID 1724 wrote to memory of 1164	1724	stubbed.exe	82

C:\Users\Admin\AppData\Local\Temp\stubbed.exe
"C:\Users\Admin\AppData\Local\Temp\stubbed.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

accfaac

Path C:\ProgramData\abchacc\bfbacfc\accfaac
Size 180B
SHA256 75d691a132c99019c72144d9432736f813efec7ce263973d385a03b05b7571bb
MD5 ed247d42180ae4a43c1b44cb687c17bf
SHA1 15e5033d74e3c46f789d50d31c8312e7ca086b42
SHA512 65836833c8846b3fff272b051618800447994cf88cc39654e23cb614009b0e24016fc3ae9008398a4ffe85ae4689b79693b5cdc0cf9294fcfce5ec6ca8d13cd5
MD5 SHA1 SHA512

Submit Download

bdbcdbd

Path C:\Users\Admin\AppData\Local\Temp\bdbcdbd
Size 60B
SHA256 44a125a9b4573232eea7f0ce386d7397c337b5fc2430db005b59eba32d00a07e
MD5 f751ffd29eb83c2966a8f8548c06bf18
SHA1 edcdf6bdc7832c1861b243dddb68467ad987cf39
SHA512 d5b91135d13412f588c6f2cbc541f7993e6979636949c20137d07137d9227f23ba4d82fb79a86c55fd244ccfebf9c721c7055d8aa8f07d3a281ed8d41223207e
MD5 SHA1 SHA512

Submit Download

memory/1164-135-0x0000000000400000-0x0000000000473000-memory.dmp

Download

memory/1164-136-0x0000000000400000-0x0000000000473000-memory.dmp

Download

memory/1164-137-0x0000000000400000-0x0000000000473000-memory.dmp

Download

memory/1164-139-0x0000000000400000-0x0000000000473000-memory.dmp

Download

memory/1164-143-0x0000000000400000-0x0000000000473000-memory.dmp

Download

memory/1164-144-0x0000000000400000-0x0000000000473000-memory.dmp

Download

memory/1164-147-0x0000000000400000-0x0000000000473000-memory.dmp

Download

memory/1164-146-0x0000000000400000-0x0000000000473000-memory.dmp

Download

memory/1164-148-0x0000000000400000-0x0000000000473000-memory.dmp

Download

memory/1724-138-0x0000000000400000-0x0000000000473000-memory.dmp

Download