Analysis
-
max time kernel
145s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12-10-2023 17:33
Static task
static1
Behavioral task
behavioral1
Sample
4952979661b152d02da944a47e29c1dd7407d8039ca4577a9578e081b19e8f78.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
4952979661b152d02da944a47e29c1dd7407d8039ca4577a9578e081b19e8f78.exe
Resource
win10v2004-20230915-en
General
-
Target
4952979661b152d02da944a47e29c1dd7407d8039ca4577a9578e081b19e8f78.exe
-
Size
322KB
-
MD5
ac7ec5342b95f9b4a70a23c9c0774443
-
SHA1
9feece16a385a7dd5bf3a096693e5cfea1d243e2
-
SHA256
4952979661b152d02da944a47e29c1dd7407d8039ca4577a9578e081b19e8f78
-
SHA512
0472f1a3c6cf4fd23bf06ad2c8e47ecb6ae6ae052cdd8a485f7396865005123a9c8eaa983a62c7cbf947c1a5dfc627665e2218b785c7f7ddfe4537d798bd031b
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2868 set thread context of 2264 2868 4952979661b152d02da944a47e29c1dd7407d8039ca4577a9578e081b19e8f78.exe 84 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2336 schtasks.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2868 wrote to memory of 2264 2868 4952979661b152d02da944a47e29c1dd7407d8039ca4577a9578e081b19e8f78.exe 84 PID 2868 wrote to memory of 2264 2868 4952979661b152d02da944a47e29c1dd7407d8039ca4577a9578e081b19e8f78.exe 84 PID 2868 wrote to memory of 2264 2868 4952979661b152d02da944a47e29c1dd7407d8039ca4577a9578e081b19e8f78.exe 84 PID 2868 wrote to memory of 2264 2868 4952979661b152d02da944a47e29c1dd7407d8039ca4577a9578e081b19e8f78.exe 84 PID 2868 wrote to memory of 2264 2868 4952979661b152d02da944a47e29c1dd7407d8039ca4577a9578e081b19e8f78.exe 84 PID 2868 wrote to memory of 2264 2868 4952979661b152d02da944a47e29c1dd7407d8039ca4577a9578e081b19e8f78.exe 84 PID 2868 wrote to memory of 2264 2868 4952979661b152d02da944a47e29c1dd7407d8039ca4577a9578e081b19e8f78.exe 84 PID 2868 wrote to memory of 2264 2868 4952979661b152d02da944a47e29c1dd7407d8039ca4577a9578e081b19e8f78.exe 84 PID 2868 wrote to memory of 2264 2868 4952979661b152d02da944a47e29c1dd7407d8039ca4577a9578e081b19e8f78.exe 84 PID 2264 wrote to memory of 2336 2264 4952979661b152d02da944a47e29c1dd7407d8039ca4577a9578e081b19e8f78.exe 89 PID 2264 wrote to memory of 2336 2264 4952979661b152d02da944a47e29c1dd7407d8039ca4577a9578e081b19e8f78.exe 89 PID 2264 wrote to memory of 2336 2264 4952979661b152d02da944a47e29c1dd7407d8039ca4577a9578e081b19e8f78.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\4952979661b152d02da944a47e29c1dd7407d8039ca4577a9578e081b19e8f78.exe"C:\Users\Admin\AppData\Local\Temp\4952979661b152d02da944a47e29c1dd7407d8039ca4577a9578e081b19e8f78.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\4952979661b152d02da944a47e29c1dd7407d8039ca4577a9578e081b19e8f78.exeC:\Users\Admin\AppData\Local\Temp\4952979661b152d02da944a47e29c1dd7407d8039ca4577a9578e081b19e8f78.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:2336
-
-