Analysis
-
max time kernel
128s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
05-09-2023 00:09
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
UmeMemqbMti9.exe
Resource
win7-20230831-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
UmeMemqbMti9.exe
Resource
win10v2004-20230831-en
4 signatures
150 seconds
General
-
Target
UmeMemqbMti9.exe
-
Size
967KB
-
MD5
29e932d3d12d1811d99691acb7f228bc
-
SHA1
4c67dd3dbb393ba68e602ed43223001bb88d94e4
-
SHA256
54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711
-
SHA512
39d2e21c86b5fd3bac702837f7c95ffe6a0119f9647998e0496a14a6c1f0f81f65fc331977ea16bc4a041d000d80942aa374538c9f9016e6e59f9eac01cdf98f
-
SSDEEP
24576:BqDEvCTbMWu7rQYlBQcBiT6rprG8aNrpmD:BTvC/MTQYxsWR7aNo
Score
6/10
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 3704 set thread context of 4776 3704 UmeMemqbMti9.exe 91 PID 3704 set thread context of 4540 3704 UmeMemqbMti9.exe 94 PID 3704 set thread context of 1592 3704 UmeMemqbMti9.exe 97 PID 3704 set thread context of 2752 3704 UmeMemqbMti9.exe 100 PID 3704 set thread context of 3440 3704 UmeMemqbMti9.exe 103 -
Program crash 5 IoCs
pid pid_target Process procid_target 1784 4776 WerFault.exe 91 1660 4540 WerFault.exe 94 4716 1592 WerFault.exe 97 1240 2752 WerFault.exe 100 4680 3440 WerFault.exe 103 -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 3704 wrote to memory of 4776 3704 UmeMemqbMti9.exe 91 PID 3704 wrote to memory of 4776 3704 UmeMemqbMti9.exe 91 PID 3704 wrote to memory of 4776 3704 UmeMemqbMti9.exe 91 PID 3704 wrote to memory of 4776 3704 UmeMemqbMti9.exe 91 PID 3704 wrote to memory of 4540 3704 UmeMemqbMti9.exe 94 PID 3704 wrote to memory of 4540 3704 UmeMemqbMti9.exe 94 PID 3704 wrote to memory of 4540 3704 UmeMemqbMti9.exe 94 PID 3704 wrote to memory of 4540 3704 UmeMemqbMti9.exe 94 PID 3704 wrote to memory of 1592 3704 UmeMemqbMti9.exe 97 PID 3704 wrote to memory of 1592 3704 UmeMemqbMti9.exe 97 PID 3704 wrote to memory of 1592 3704 UmeMemqbMti9.exe 97 PID 3704 wrote to memory of 1592 3704 UmeMemqbMti9.exe 97 PID 3704 wrote to memory of 1592 3704 UmeMemqbMti9.exe 97 PID 3704 wrote to memory of 1592 3704 UmeMemqbMti9.exe 97 PID 3704 wrote to memory of 2752 3704 UmeMemqbMti9.exe 100 PID 3704 wrote to memory of 2752 3704 UmeMemqbMti9.exe 100 PID 3704 wrote to memory of 2752 3704 UmeMemqbMti9.exe 100 PID 3704 wrote to memory of 2752 3704 UmeMemqbMti9.exe 100 PID 3704 wrote to memory of 3440 3704 UmeMemqbMti9.exe 103 PID 3704 wrote to memory of 3440 3704 UmeMemqbMti9.exe 103 PID 3704 wrote to memory of 3440 3704 UmeMemqbMti9.exe 103 PID 3704 wrote to memory of 3440 3704 UmeMemqbMti9.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\UmeMemqbMti9.exe"C:\Users\Admin\AppData\Local\Temp\UmeMemqbMti9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵PID:4776
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 803⤵
- Program crash
PID:1784
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵PID:4540
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 803⤵
- Program crash
PID:1660
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵PID:1592
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 803⤵
- Program crash
PID:4716
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵PID:2752
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 803⤵
- Program crash
PID:1240
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵PID:3440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 803⤵
- Program crash
PID:4680
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4776 -ip 47761⤵PID:2536
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4540 -ip 45401⤵PID:2584
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 1592 -ip 15921⤵PID:3776
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2752 -ip 27521⤵PID:1016
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3440 -ip 34401⤵PID:2188