8dae52db58c1d51d1c42e027d91637bfb075d47f1ea07ed96d651081fcc88ca9

Analysis

max time kernel
2s
max time network
8s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/12/2023, 12:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b3e3b0cf24888c7a5bd087ba68518162.exe
Size 58KB
Sample231220-px6dkaebd8
SHA256 8dae52db58c1d51d1c42e027d91637bfb075d47f1ea07ed96d651081fcc88ca9
MD5 b3e3b0cf24888c7a5bd087ba68518162
SHA1 abbac0cd304ace407f744127fb3ff1c0ef2b66be
SHA512 151c8bf6eb6cea59086f9bac6fd549b5cdd45b0308fc54ae41fb76c6c705c6b3019d5cf65cfc3a5b1437f1e7103ad6b31d0eb0d8557f56bd87c88de955de40f9
SSDEEP 768:aM5WaKyBevI8OHKA+hmXid6Z9HUEMyerTAzwavKCFC/nGVykmBdwxkpNZsP:55P2vIg7dNrTAzZv3FaGU5LRm
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2924 set thread context of 2304	2924	b3e3b0cf24888c7a5bd087ba68518162.exe	91

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2996	winver.exe
2996	winver.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2996	winver.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2924	b3e3b0cf24888c7a5bd087ba68518162.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2304	2924	b3e3b0cf24888c7a5bd087ba68518162.exe	91
PID 2924 wrote to memory of 2304	2924	b3e3b0cf24888c7a5bd087ba68518162.exe	91
PID 2924 wrote to memory of 2304	2924	b3e3b0cf24888c7a5bd087ba68518162.exe	91
PID 2924 wrote to memory of 2304	2924	b3e3b0cf24888c7a5bd087ba68518162.exe	91
PID 2924 wrote to memory of 2304	2924	b3e3b0cf24888c7a5bd087ba68518162.exe	91
PID 2924 wrote to memory of 2304	2924	b3e3b0cf24888c7a5bd087ba68518162.exe	91
PID 2304 wrote to memory of 2996	2304	b3e3b0cf24888c7a5bd087ba68518162.exe	92
PID 2304 wrote to memory of 2996	2304	b3e3b0cf24888c7a5bd087ba68518162.exe	92
PID 2304 wrote to memory of 2996	2304	b3e3b0cf24888c7a5bd087ba68518162.exe	92
PID 2304 wrote to memory of 2996	2304	b3e3b0cf24888c7a5bd087ba68518162.exe	92
PID 2996 wrote to memory of 3460	2996	winver.exe	51
PID 2996 wrote to memory of 3016	2996	winver.exe	83
PID 2996 wrote to memory of 3064	2996	winver.exe	82

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3460
- C:\Users\Admin\AppData\Local\Temp\b3e3b0cf24888c7a5bd087ba68518162.exe
  "C:\Users\Admin\AppData\Local\Temp\b3e3b0cf24888c7a5bd087ba68518162.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Users\Admin\AppData\Local\Temp\b3e3b0cf24888c7a5bd087ba68518162.exe
    "C:\Users\Admin\AppData\Local\Temp\b3e3b0cf24888c7a5bd087ba68518162.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2304
  - - C:\Windows\SysWOW64\winver.exe
      winver
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3064

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2304-14-0x00000000006C0000-0x00000000010C0000-memory.dmp

Download

memory/2304-2-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2304-7-0x00000000006C0000-0x00000000010C0000-memory.dmp

Download

memory/2596-18-0x00000000001D0000-0x00000000001D6000-memory.dmp

Download

memory/2996-6-0x00000000005C0000-0x00000000005C6000-memory.dmp

Download

memory/2996-4-0x00000000005C0000-0x00000000005C6000-memory.dmp

Download

memory/2996-8-0x00000000005C0000-0x00000000005C6000-memory.dmp

Download

memory/2996-10-0x0000000077472000-0x0000000077473000-memory.dmp

Download

memory/2996-11-0x0000000000AF0000-0x0000000000B02000-memory.dmp

Download

memory/3016-17-0x0000000000700000-0x0000000000706000-memory.dmp

Download

memory/3016-15-0x0000000000700000-0x0000000000706000-memory.dmp

Download

memory/3064-16-0x00000000001E0000-0x00000000001E6000-memory.dmp

Download

memory/3064-19-0x00000000001E0000-0x00000000001E6000-memory.dmp

Download

memory/3460-3-0x0000000002060000-0x0000000002066000-memory.dmp

Download

memory/3460-9-0x00007FF846B0D000-0x00007FF846B0E000-memory.dmp

Download

memory/3460-5-0x0000000002060000-0x0000000002066000-memory.dmp

Download

memory/3460-20-0x00000000006C0000-0x00000000006C6000-memory.dmp

Download

memory/3460-23-0x00000000006C0000-0x00000000006C6000-memory.dmp

Download

memory/3608-22-0x00000000001B0000-0x00000000001B6000-memory.dmp

Download

memory/3788-24-0x0000000000050000-0x0000000000056000-memory.dmp

Download