Analysis
-
max time kernel
40s -
max time network
44s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
13/11/2023, 02:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
main_bin.exe
Resource
win7-20231023-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
main_bin.exe
Resource
win10v2004-20231020-en
4 signatures
150 seconds
General
-
Target
main_bin.exe
-
Size
165KB
-
MD5
a84e1256111e4e235250a8e3bb11f903
-
SHA1
1b76e5a645a0df61bb4569d54bd1183ab451c95e
-
SHA256
a0ac02a1e6c908b90173e86c3e321f2bab082ed45236503a21eb7d984de10611
-
SHA512
27d26faf85b32e58a5a1ecd391c7f6c4cb1dbd494a8fd66369652c26a89c4a1eeae7124696b41cd851b5e5e787d3aabd67a1f656001d0e509018fbb414667ab2
-
SSDEEP
3072:eOFEQVKT/M/j2kX7qyAuLRpsPvpXmo0WTfG3PzoNE9cXh6yrfDop4B13:3FnA02kguLR4mo0CfG3LoicXh6q7y4BJ
Score
6/10
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4104 set thread context of 5116 4104 main_bin.exe 86 PID 3568 set thread context of 4284 3568 svchost.exe 96 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5116 main_bin.exe 5116 main_bin.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 4104 wrote to memory of 5116 4104 main_bin.exe 86 PID 4104 wrote to memory of 5116 4104 main_bin.exe 86 PID 4104 wrote to memory of 5116 4104 main_bin.exe 86 PID 4104 wrote to memory of 5116 4104 main_bin.exe 86 PID 4104 wrote to memory of 5116 4104 main_bin.exe 86 PID 4104 wrote to memory of 5116 4104 main_bin.exe 86 PID 4104 wrote to memory of 5116 4104 main_bin.exe 86 PID 4104 wrote to memory of 5116 4104 main_bin.exe 86 PID 4104 wrote to memory of 5116 4104 main_bin.exe 86 PID 5116 wrote to memory of 3568 5116 main_bin.exe 87 PID 5116 wrote to memory of 3568 5116 main_bin.exe 87 PID 5116 wrote to memory of 3568 5116 main_bin.exe 87 PID 5116 wrote to memory of 3568 5116 main_bin.exe 87 PID 3568 wrote to memory of 4284 3568 svchost.exe 96 PID 3568 wrote to memory of 4284 3568 svchost.exe 96 PID 3568 wrote to memory of 4284 3568 svchost.exe 96 PID 3568 wrote to memory of 4284 3568 svchost.exe 96 PID 3568 wrote to memory of 4284 3568 svchost.exe 96 PID 3568 wrote to memory of 4284 3568 svchost.exe 96 PID 3568 wrote to memory of 4284 3568 svchost.exe 96 PID 3568 wrote to memory of 4284 3568 svchost.exe 96 PID 3568 wrote to memory of 4284 3568 svchost.exe 96 PID 3568 wrote to memory of 4284 3568 svchost.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\main_bin.exe"C:\Users\Admin\AppData\Local\Temp\main_bin.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\main_bin.exe"C:\Users\Admin\AppData\Local\Temp\main_bin.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\System32\svchost.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\System32\svchost.exe"4⤵PID:4284
-
-
-