Analysis
-
max time kernel
118s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
13-10-2023 05:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe
Resource
win7-20230831-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe
Resource
win10v2004-20230915-en
amadeyhealermysticredlinesectopratsmokeloader5141679758_99@ytlogsbotbrehakukishmonikpixelscloud2.0backdoordropperinfostealerpersistenceratstealertrojan
windows10-2004-x64
24 signatures
150 seconds
General
-
Target
e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe
-
Size
1.4MB
-
MD5
7231c794f761b16bbeae945d3cfca6a0
-
SHA1
404dbc5358a0164d615bd1e75cb6c42daa704f67
-
SHA256
e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c
-
SHA512
c851a3230b71e20d860152b6f3b8873920a5aaf41f25e55038c5bf379d297197377e9f6b03ec226766a905d5e91b620560567e8e3dd440943d41fe468ae7e717
-
SSDEEP
24576:6i5lutKB+GLSI3M/i6xv3JnGAMxkpKjAA02lvlozIrdbol/RTdDf0x2gNMSeXST8:x5lutKB+GuI8KqxnZmkpxA0WlozibM/Z
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1256 set thread context of 2728 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 32 -
Program crash 1 IoCs
pid pid_target Process procid_target 2596 2728 WerFault.exe 32 -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 1256 wrote to memory of 2588 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 29 PID 1256 wrote to memory of 2588 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 29 PID 1256 wrote to memory of 2588 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 29 PID 1256 wrote to memory of 2588 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 29 PID 1256 wrote to memory of 2588 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 29 PID 1256 wrote to memory of 2588 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 29 PID 1256 wrote to memory of 2588 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 29 PID 1256 wrote to memory of 2464 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 34 PID 1256 wrote to memory of 2464 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 34 PID 1256 wrote to memory of 2464 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 34 PID 1256 wrote to memory of 2464 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 34 PID 1256 wrote to memory of 2464 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 34 PID 1256 wrote to memory of 2464 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 34 PID 1256 wrote to memory of 2464 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 34 PID 1256 wrote to memory of 1152 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 33 PID 1256 wrote to memory of 1152 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 33 PID 1256 wrote to memory of 1152 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 33 PID 1256 wrote to memory of 1152 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 33 PID 1256 wrote to memory of 1152 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 33 PID 1256 wrote to memory of 1152 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 33 PID 1256 wrote to memory of 1152 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 33 PID 1256 wrote to memory of 2728 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 32 PID 1256 wrote to memory of 2728 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 32 PID 1256 wrote to memory of 2728 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 32 PID 1256 wrote to memory of 2728 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 32 PID 1256 wrote to memory of 2728 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 32 PID 1256 wrote to memory of 2728 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 32 PID 1256 wrote to memory of 2728 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 32 PID 1256 wrote to memory of 2728 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 32 PID 1256 wrote to memory of 2728 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 32 PID 1256 wrote to memory of 2728 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 32 PID 1256 wrote to memory of 2728 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 32 PID 1256 wrote to memory of 2728 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 32 PID 1256 wrote to memory of 2728 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 32 PID 1256 wrote to memory of 2728 1256 e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe 32 PID 2728 wrote to memory of 2596 2728 AppLaunch.exe 35 PID 2728 wrote to memory of 2596 2728 AppLaunch.exe 35 PID 2728 wrote to memory of 2596 2728 AppLaunch.exe 35 PID 2728 wrote to memory of 2596 2728 AppLaunch.exe 35 PID 2728 wrote to memory of 2596 2728 AppLaunch.exe 35 PID 2728 wrote to memory of 2596 2728 AppLaunch.exe 35 PID 2728 wrote to memory of 2596 2728 AppLaunch.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe"C:\Users\Admin\AppData\Local\Temp\e253e4c530f08b374cc4b9c558d1af05a15b0b3a4ce4ce8780c54f8ca6d8892c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:2588
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 2003⤵
- Program crash
PID:2596
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:1152
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:2464
-