6a096c8158da4e2453ba68fe0f780c2e4181c01f125d7831fc5d58a77faf792c

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
26-09-2023 07:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eee.exe
Size

447KB
MD5

89f71046c8298c6ef2db92fe202f9b43
SHA1

1fad31eedaa7437e96f9a13f60e85c1d14afa08f
SHA256

6a096c8158da4e2453ba68fe0f780c2e4181c01f125d7831fc5d58a77faf792c
SHA512

972abc83a524cca9ac8c326c2d4e8cc49f4b877965ba6bce941b7a1b13ae7fd4306cffdb63e1bcbede44aca7a515a13d67db77045e502e8424e9d7d95e95a2d4
SSDEEP

6144:PW/OU+cR2lBLVa8MK1hmcRwpq/JiTTUh/:eR2jLt1hmcRwpq/JiTTUh/

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

eee.exe

description pid process target process

PID 4508 set thread context of 4540 4508 eee.exe cmd.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

eee.execmd.exe

pid process

4508 eee.exe
4540 cmd.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

eee.execmd.exe

pid process

4508 eee.exe
4540 cmd.exe

description	pid	process	target process
PID 4508 set thread context of 4540	4508	eee.exe	cmd.exe

pid	process
4508	eee.exe
4540	cmd.exe

pid	process
4508	eee.exe
4540	cmd.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

eee.execmd.exe

description	pid	process	target process
PID 4508 wrote to memory of 4540	4508	eee.exe	cmd.exe
PID 4508 wrote to memory of 4540	4508	eee.exe	cmd.exe
PID 4508 wrote to memory of 4540	4508	eee.exe	cmd.exe
PID 4508 wrote to memory of 4540	4508	eee.exe	cmd.exe
PID 4540 wrote to memory of 4652	4540	cmd.exe	explorer.exe
PID 4540 wrote to memory of 4652	4540	cmd.exe	explorer.exe
PID 4540 wrote to memory of 4652	4540	cmd.exe	explorer.exe
PID 4540 wrote to memory of 4652	4540	cmd.exe	explorer.exe
PID 4540 wrote to memory of 4652	4540	cmd.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\eee.exe
"C:\Users\Admin\AppData\Local\Temp\eee.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    PID:4652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2c7f9288

Filesize
1.0MB

MD5
555ac6bfa9779d576b70d507e7c0dac0

SHA1
e80f68ceaf96518b4b72e61afdc72f3250b500b2

SHA256
3924191a420525e1321316eed2b874f0464fa2a2606baa3193a3c657628a354f

SHA512
6dc853c296aedd240a26a773d00f0393de0cd8a367e1842b99813a4a0d68d63b359051361efcad6a287d8db8724237d32b422777ed532c6fe7e3c894cd05f58c

Download Submit
memory/4508-0-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4508-2-0x0000000077180000-0x000000007723F000-memory.dmp

Filesize
764KB

Download
memory/4508-3-0x0000000077180000-0x000000007723F000-memory.dmp

Filesize
764KB

Download
memory/4508-4-0x0000000077180000-0x000000007723F000-memory.dmp

Filesize
764KB

Download
memory/4540-9-0x0000000000890000-0x000000000094F000-memory.dmp

Filesize
764KB

Download
memory/4540-7-0x00007FFC1B7D0000-0x00007FFC1B9C5000-memory.dmp

Filesize
2.0MB

Download
memory/4540-10-0x0000000000890000-0x000000000094F000-memory.dmp

Filesize
764KB

Download
memory/4652-12-0x0000000000AA0000-0x0000000000B1A000-memory.dmp

Filesize
488KB

Download
memory/4652-13-0x00007FFC1B7D0000-0x00007FFC1B9C5000-memory.dmp

Filesize
2.0MB

Download
memory/4652-14-0x0000000000AA0000-0x0000000000B1A000-memory.dmp

Filesize
488KB

Download
memory/4652-15-0x0000000000DA0000-0x00000000011D3000-memory.dmp

Filesize
4.2MB

Download
memory/4652-16-0x0000000000AA0000-0x0000000000B1A000-memory.dmp

Filesize
488KB

Download
memory/4652-17-0x0000000000AA0000-0x0000000000B1A000-memory.dmp

Filesize
488KB

Download