6a096c8158da4e2453ba68fe0f780c2e4181c01f125d7831fc5d58a77faf792c

Resubmissions

26-09-2023 23:32

230926-3jmwysec2t 10

26-09-2023 19:57

230926-ypd4sadc8z 3

26-09-2023 07:46

230926-jly78afe7v 5

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
26-09-2023 07:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eee.exe
Size

447KB
MD5

89f71046c8298c6ef2db92fe202f9b43
SHA1

1fad31eedaa7437e96f9a13f60e85c1d14afa08f
SHA256

6a096c8158da4e2453ba68fe0f780c2e4181c01f125d7831fc5d58a77faf792c
SHA512

972abc83a524cca9ac8c326c2d4e8cc49f4b877965ba6bce941b7a1b13ae7fd4306cffdb63e1bcbede44aca7a515a13d67db77045e502e8424e9d7d95e95a2d4
SSDEEP

6144:PW/OU+cR2lBLVa8MK1hmcRwpq/JiTTUh/:eR2jLt1hmcRwpq/JiTTUh/

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2900 set thread context of 2164	2900	eee.exe	86

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2900	eee.exe
2164	cmd.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2900	eee.exe
2164	cmd.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2164	2900	eee.exe	86
PID 2900 wrote to memory of 2164	2900	eee.exe	86
PID 2900 wrote to memory of 2164	2900	eee.exe	86
PID 2900 wrote to memory of 2164	2900	eee.exe	86
PID 2164 wrote to memory of 4144	2164	cmd.exe	99
PID 2164 wrote to memory of 4144	2164	cmd.exe	99
PID 2164 wrote to memory of 4144	2164	cmd.exe	99
PID 2164 wrote to memory of 4144	2164	cmd.exe	99
PID 2164 wrote to memory of 4144	2164	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\eee.exe
"C:\Users\Admin\AppData\Local\Temp\eee.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    PID:4144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\15583611

Filesize
1.0MB

MD5
96af17f287e3f1cab4ea1edd686d6de7

SHA1
0006ea28f80c13d89802aceda92436f58b6cf72c

SHA256
be6bc96d31242c326b37fb3e1e2aca9c527cff5c90cedf3758116ac14e9c421a

SHA512
703dce3a06404b7af7fe285d871c554bf1b46913eb77fa10788d49fb02550ef8e2be410fa6d570ef5b3eb996e68c813f8adc12811217e9d0ed0c615399d0afe8

Download Submit
memory/2164-7-0x00007FFC76EF0000-0x00007FFC770E5000-memory.dmp

Filesize
2.0MB

Download
memory/2164-12-0x0000000000AB0000-0x0000000000B6F000-memory.dmp

Filesize
764KB

Download
memory/2164-10-0x0000000000AB0000-0x0000000000B6F000-memory.dmp

Filesize
764KB

Download
memory/2164-9-0x0000000000AB0000-0x0000000000B6F000-memory.dmp

Filesize
764KB

Download
memory/2900-4-0x00000000764B0000-0x000000007656F000-memory.dmp

Filesize
764KB

Download
memory/2900-0-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2900-3-0x00000000764B0000-0x000000007656F000-memory.dmp

Filesize
764KB

Download
memory/2900-2-0x00000000764B0000-0x000000007656F000-memory.dmp

Filesize
764KB

Download
memory/4144-13-0x00007FFC76EF0000-0x00007FFC770E5000-memory.dmp

Filesize
2.0MB

Download
memory/4144-14-0x00000000006E0000-0x000000000075A000-memory.dmp

Filesize
488KB

Download
memory/4144-17-0x00000000006E0000-0x000000000075A000-memory.dmp

Filesize
488KB

Download
memory/4144-18-0x0000000000840000-0x0000000000C73000-memory.dmp

Filesize
4.2MB

Download
memory/4144-19-0x00000000006E0000-0x000000000075A000-memory.dmp

Filesize
488KB

Download