4a35f8134f64ad28c5fe261d7cf15256ecd758566c2ddbf4bd962925502ade41

Analysis

max time kernel
143s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2023, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fmodstudio64.exe
Size 3.8MB
Sample231003-weksgagc75
SHA256 4a35f8134f64ad28c5fe261d7cf15256ecd758566c2ddbf4bd962925502ade41
MD5 5f32065d2330cb09aee6ed9fa7ed1c21
SHA1 b5d617bc1626cf79821f2f0c0e2e043f04da5707
SHA512 35a70e1d757f5a5d53a5266b383decf5d6c97e06195cbc9684be0514c9638b5c1cd5b76c294d2c7ab40da0259e6b757dc2aa7a5d54baf22db3b5c7e082361b45
SSDEEP 98304:UVHFXSCmqsSgfkV9ft9gnOMmgqT6d9y426tTB:UVHFXSCmqsMXl9oPfCzB09
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 540 set thread context of 5100	540	fmodstudio64.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
540	fmodstudio64.exe
540	fmodstudio64.exe
5100	cmd.exe
5100	cmd.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
540	fmodstudio64.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 5100	540	fmodstudio64.exe	93
PID 540 wrote to memory of 5100	540	fmodstudio64.exe	93
PID 540 wrote to memory of 5100	540	fmodstudio64.exe	93
PID 540 wrote to memory of 5100	540	fmodstudio64.exe	93

C:\Users\Admin\AppData\Local\Temp\fmodstudio64.exe
"C:\Users\Admin\AppData\Local\Temp\fmodstudio64.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1ccbfc79

Path C:\Users\Admin\AppData\Local\Temp\1ccbfc79
Size 799KB
SHA256 903657d670079a906a2e32d7aaac6b9a60ecec32ea5fe56aedd1217f09082b1f
MD5 242ce65252ee900c6933cab640af29c1
SHA1 abd5e02a32e7fd6baa54fa0c97479b33838c3b28
SHA512 2696c8b7d6c2357806436f82fb8e648976e2e8da5ff11b8f7cd0f0a572cc16e9ec68b879730ab3181aa7254a1902c742538fb9626e910a5b11ec82aaeb1be65b
SSDEEP 12288:7m8Zlh2Bi80ZBTZ7nMv9+VfSDgZ0zL6JIiM0/CL:6GZnPTGv9+5SDgyzG/qL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/540-0-0x0000000000400000-0x00000000006FB000-memory.dmp

Download

memory/540-1-0x0000000074230000-0x00000000743AB000-memory.dmp

Download

memory/540-2-0x0000000074230000-0x00000000743AB000-memory.dmp

Download

memory/540-3-0x0000000074230000-0x00000000743AB000-memory.dmp

Download

memory/5100-5-0x0000000074230000-0x00000000743AB000-memory.dmp

Download

memory/5100-7-0x00007FF83D2D0000-0x00007FF83D4C5000-memory.dmp

Download