a12c63a33382720b5ce010cc050106c3909316477b956ca8c17f4a1f6ca6aa42

Resubmissions

22/09/2023, 04:27

230922-e2589aeh486

22/09/2023, 04:17

230922-ewnr1sch3x10

Analysis

max time kernel
30s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
22/09/2023, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a12c63a33382720b5ce010cc050106c3909316477b956ca8c17f4a1f6ca6aa42.exe
Size 239KB
Sample230922-e2589aeh48
SHA256 a12c63a33382720b5ce010cc050106c3909316477b956ca8c17f4a1f6ca6aa42
MD5 3240f8928a130bb155571570c563200a
SHA1 aa621ddde551f7e0dbeed157ab1eac3f1906f493
SHA512 e7c357e54b7768f1a66e0dabe2c604afe3765eb858f8b4e5751659a4b373b10fb6cc1dc72641aabf83e34d097f28fa70a78482310ecd93e9aa0347378bde409b
SSDEEP 6144:dMcz8EQnRrxT5t9kFIndDK4lY4xohYA1au77C0G:dM7XnPz9uIgGLxoSA06
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1004 set thread context of 2240	1004	a12c63a33382720b5ce010cc050106c3909316477b956ca8c17f4a1f6ca6aa42.exe	86

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2240	AddInProcess32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 1424	1004	a12c63a33382720b5ce010cc050106c3909316477b956ca8c17f4a1f6ca6aa42.exe	85
PID 1004 wrote to memory of 1424	1004	a12c63a33382720b5ce010cc050106c3909316477b956ca8c17f4a1f6ca6aa42.exe	85
PID 1004 wrote to memory of 1424	1004	a12c63a33382720b5ce010cc050106c3909316477b956ca8c17f4a1f6ca6aa42.exe	85
PID 1004 wrote to memory of 1424	1004	a12c63a33382720b5ce010cc050106c3909316477b956ca8c17f4a1f6ca6aa42.exe	85
PID 1004 wrote to memory of 2240	1004	a12c63a33382720b5ce010cc050106c3909316477b956ca8c17f4a1f6ca6aa42.exe	86
PID 1004 wrote to memory of 2240	1004	a12c63a33382720b5ce010cc050106c3909316477b956ca8c17f4a1f6ca6aa42.exe	86
PID 1004 wrote to memory of 2240	1004	a12c63a33382720b5ce010cc050106c3909316477b956ca8c17f4a1f6ca6aa42.exe	86
PID 1004 wrote to memory of 2240	1004	a12c63a33382720b5ce010cc050106c3909316477b956ca8c17f4a1f6ca6aa42.exe	86
PID 1004 wrote to memory of 2240	1004	a12c63a33382720b5ce010cc050106c3909316477b956ca8c17f4a1f6ca6aa42.exe	86
PID 1004 wrote to memory of 2240	1004	a12c63a33382720b5ce010cc050106c3909316477b956ca8c17f4a1f6ca6aa42.exe	86
PID 1004 wrote to memory of 2240	1004	a12c63a33382720b5ce010cc050106c3909316477b956ca8c17f4a1f6ca6aa42.exe	86
PID 1004 wrote to memory of 2240	1004	a12c63a33382720b5ce010cc050106c3909316477b956ca8c17f4a1f6ca6aa42.exe	86

C:\Users\Admin\AppData\Local\Temp\a12c63a33382720b5ce010cc050106c3909316477b956ca8c17f4a1f6ca6aa42.exe
"C:\Users\Admin\AppData\Local\Temp\a12c63a33382720b5ce010cc050106c3909316477b956ca8c17f4a1f6ca6aa42.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:1424
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2240-0-0x0000000074700000-0x0000000074EB0000-memory.dmp

Download

memory/2240-1-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2240-2-0x0000000004D80000-0x0000000004D90000-memory.dmp

Download

memory/2240-3-0x0000000074700000-0x0000000074EB0000-memory.dmp

Download

memory/2240-4-0x0000000004D80000-0x0000000004D90000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads