6a096c8158da4e2453ba68fe0f780c2e4181c01f125d7831fc5d58a77faf792c

Analysis

max time kernel
150s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
26-09-2023 07:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eee.exe
Size

447KB
MD5

89f71046c8298c6ef2db92fe202f9b43
SHA1

1fad31eedaa7437e96f9a13f60e85c1d14afa08f
SHA256

6a096c8158da4e2453ba68fe0f780c2e4181c01f125d7831fc5d58a77faf792c
SHA512

972abc83a524cca9ac8c326c2d4e8cc49f4b877965ba6bce941b7a1b13ae7fd4306cffdb63e1bcbede44aca7a515a13d67db77045e502e8424e9d7d95e95a2d4
SSDEEP

6144:PW/OU+cR2lBLVa8MK1hmcRwpq/JiTTUh/:eR2jLt1hmcRwpq/JiTTUh/

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1460 set thread context of 3624	1460	eee.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1460	eee.exe
3624	cmd.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1460	eee.exe
3624	cmd.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 3624	1460	eee.exe	84
PID 1460 wrote to memory of 3624	1460	eee.exe	84
PID 1460 wrote to memory of 3624	1460	eee.exe	84
PID 1460 wrote to memory of 3624	1460	eee.exe	84
PID 3624 wrote to memory of 3312	3624	cmd.exe	95
PID 3624 wrote to memory of 3312	3624	cmd.exe	95
PID 3624 wrote to memory of 3312	3624	cmd.exe	95
PID 3624 wrote to memory of 3312	3624	cmd.exe	95
PID 3624 wrote to memory of 3312	3624	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\eee.exe
"C:\Users\Admin\AppData\Local\Temp\eee.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3624
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    PID:3312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2cf78b5a

Filesize
1.0MB

MD5
f3cebde350893367e7ed4c056ba7f6f9

SHA1
ee5762ed0ba07a2ac760757d1a0ba49790f612a8

SHA256
e42ef77e46e52d499d5533b99807a2c75748cce024e0476edee2fa7d98d1a998

SHA512
f92a14341d650b66b8070fa0308d550944df634cc417ff93c1184114df83e2fe35f80111f795425d9f370a49f41d5f6a58f42c6ee4eb13e17962a99239ee8f24

Download Submit
memory/1460-0-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1460-2-0x00000000759E0000-0x0000000075A9F000-memory.dmp

Filesize
764KB

Download
memory/1460-3-0x00000000759E0000-0x0000000075A9F000-memory.dmp

Filesize
764KB

Download
memory/1460-4-0x00000000759E0000-0x0000000075A9F000-memory.dmp

Filesize
764KB

Download
memory/3312-13-0x00007FF88BBD0000-0x00007FF88BDC5000-memory.dmp

Filesize
2.0MB

Download
memory/3312-12-0x0000000000F50000-0x0000000000FCA000-memory.dmp

Filesize
488KB

Download
memory/3312-14-0x0000000000F50000-0x0000000000FCA000-memory.dmp

Filesize
488KB

Download
memory/3312-15-0x00000000004F0000-0x0000000000923000-memory.dmp

Filesize
4.2MB

Download
memory/3312-16-0x0000000000F50000-0x0000000000FCA000-memory.dmp

Filesize
488KB

Download
memory/3312-17-0x0000000000F50000-0x0000000000FCA000-memory.dmp

Filesize
488KB

Download
memory/3624-9-0x0000000001110000-0x00000000011CF000-memory.dmp

Filesize
764KB

Download
memory/3624-10-0x0000000001110000-0x00000000011CF000-memory.dmp

Filesize
764KB

Download
memory/3624-7-0x00007FF88BBD0000-0x00007FF88BDC5000-memory.dmp

Filesize
2.0MB

Download