Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
04-09-2023 16:33
Static task
static1
Behavioral task
behavioral1
Sample
022a6ae69137ab4116487f116d484a77c5d8f0b6a1ee5adb49a418bbcdc0bab1.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
022a6ae69137ab4116487f116d484a77c5d8f0b6a1ee5adb49a418bbcdc0bab1.exe
Resource
win10v2004-20230831-en
General
-
Target
022a6ae69137ab4116487f116d484a77c5d8f0b6a1ee5adb49a418bbcdc0bab1.exe
-
Size
812KB
-
MD5
7d934671cdac240eaa9a5d022e5b4e3d
-
SHA1
efb75ead1767389f0ec560045a3ae683a1fe99fb
-
SHA256
022a6ae69137ab4116487f116d484a77c5d8f0b6a1ee5adb49a418bbcdc0bab1
-
SHA512
98ebc140149cc3dbe5e195d295bc5847e6f7db1328dc69792b91b734a73d45bced038e329fe2a6fdb9d72df146550e002bc36b3f66036aa234cfdb3c44673818
-
SSDEEP
12288:BqmytVdB0rPEDb3kCoI641jxy7GHEX2rnAv8MktrOKxp22CMOZ/1Sq:BqxtVfNDb31oT41+aneOrO4p2zMOZ/V
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2560 1E0F0D0B120A156D155C15E0A0F160C0A160F.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 4408 022a6ae69137ab4116487f116d484a77c5d8f0b6a1ee5adb49a418bbcdc0bab1.exe 2560 1E0F0D0B120A156D155C15E0A0F160C0A160F.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4408 wrote to memory of 2560 4408 022a6ae69137ab4116487f116d484a77c5d8f0b6a1ee5adb49a418bbcdc0bab1.exe 84 PID 4408 wrote to memory of 2560 4408 022a6ae69137ab4116487f116d484a77c5d8f0b6a1ee5adb49a418bbcdc0bab1.exe 84 PID 4408 wrote to memory of 2560 4408 022a6ae69137ab4116487f116d484a77c5d8f0b6a1ee5adb49a418bbcdc0bab1.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\022a6ae69137ab4116487f116d484a77c5d8f0b6a1ee5adb49a418bbcdc0bab1.exe"C:\Users\Admin\AppData\Local\Temp\022a6ae69137ab4116487f116d484a77c5d8f0b6a1ee5adb49a418bbcdc0bab1.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\1E0F0D0B120A156D155C15E0A0F160C0A160F.exeC:\Users\Admin\AppData\Local\Temp\1E0F0D0B120A156D155C15E0A0F160C0A160F.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2560
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
812KB
MD5112fc92c437be692e773ad6e83b3dc8e
SHA14df451409c797cdb9bb83e2d6d0bf8135605ea4e
SHA2568c93a39a816a03ada73c767a497e33c40c4e624cabb7758efa1da5688232b63c
SHA5125ae4b9c4d47d405aa86f711266d8c78738248e92229b7837f1c87d80babcca74b8b651c55a664d67e5fc3ab08122e008c53ead47c72d05d4ac0f9aabeac87fb5
-
Filesize
812KB
MD5112fc92c437be692e773ad6e83b3dc8e
SHA14df451409c797cdb9bb83e2d6d0bf8135605ea4e
SHA2568c93a39a816a03ada73c767a497e33c40c4e624cabb7758efa1da5688232b63c
SHA5125ae4b9c4d47d405aa86f711266d8c78738248e92229b7837f1c87d80babcca74b8b651c55a664d67e5fc3ab08122e008c53ead47c72d05d4ac0f9aabeac87fb5