7441f58afc873195fc479a9b253fbb1ce896783936fa3ca9cfa16b087a9a9be2

Analysis

max time kernel
149s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 08:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60618a6382bb5129ceb7f7aa4431e2b7.exe
Size

548KB
MD5

60618a6382bb5129ceb7f7aa4431e2b7
SHA1

66fc895ae8e107241042532b467bf54a5ad810d3
SHA256

7441f58afc873195fc479a9b253fbb1ce896783936fa3ca9cfa16b087a9a9be2
SHA512

832aaa45f4b87e8e2bd8fb61d597a46ef5368b79c20034c3ad89ebc537eab549c30342fa52da1c535f7e24e2f9a87f4c7cf9ca2847763688bc1dd86b732efec0
SSDEEP

12288:Ymczlwp05f2Mfjp3bPU/4yK/lGRgOUqmq9kR6lhKXxh+LqmXFLfIw5:Ymolwp05LjiK/cRgOnmq9g6C+zpr5

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4888 set thread context of 3608	4888	60618a6382bb5129ceb7f7aa4431e2b7.exe	95

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3608	60618a6382bb5129ceb7f7aa4431e2b7.exe
3608	60618a6382bb5129ceb7f7aa4431e2b7.exe
3608	60618a6382bb5129ceb7f7aa4431e2b7.exe
3608	60618a6382bb5129ceb7f7aa4431e2b7.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4888	60618a6382bb5129ceb7f7aa4431e2b7.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 3608	4888	60618a6382bb5129ceb7f7aa4431e2b7.exe	95
PID 4888 wrote to memory of 3608	4888	60618a6382bb5129ceb7f7aa4431e2b7.exe	95
PID 4888 wrote to memory of 3608	4888	60618a6382bb5129ceb7f7aa4431e2b7.exe	95
PID 4888 wrote to memory of 3608	4888	60618a6382bb5129ceb7f7aa4431e2b7.exe	95
PID 4888 wrote to memory of 3608	4888	60618a6382bb5129ceb7f7aa4431e2b7.exe	95
PID 4888 wrote to memory of 3608	4888	60618a6382bb5129ceb7f7aa4431e2b7.exe	95
PID 4888 wrote to memory of 3608	4888	60618a6382bb5129ceb7f7aa4431e2b7.exe	95
PID 3608 wrote to memory of 3500	3608	60618a6382bb5129ceb7f7aa4431e2b7.exe	63
PID 3608 wrote to memory of 3500	3608	60618a6382bb5129ceb7f7aa4431e2b7.exe	63
PID 3608 wrote to memory of 3500	3608	60618a6382bb5129ceb7f7aa4431e2b7.exe	63
PID 3608 wrote to memory of 3500	3608	60618a6382bb5129ceb7f7aa4431e2b7.exe	63

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3500
- C:\Users\Admin\AppData\Local\Temp\60618a6382bb5129ceb7f7aa4431e2b7.exe
  "C:\Users\Admin\AppData\Local\Temp\60618a6382bb5129ceb7f7aa4431e2b7.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Users\Admin\AppData\Local\Temp\60618a6382bb5129ceb7f7aa4431e2b7.exe
    C:\Users\Admin\AppData\Local\Temp\60618a6382bb5129ceb7f7aa4431e2b7.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3500-70-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3608-59-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3608-62-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3608-63-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/3608-64-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3608-68-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3608-76-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4888-28-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4888-41-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4888-5-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/4888-4-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/4888-33-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4888-8-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/4888-7-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/4888-10-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/4888-9-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/4888-11-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/4888-12-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/4888-14-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/4888-13-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/4888-15-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4888-17-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4888-16-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4888-19-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4888-18-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4888-20-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4888-21-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4888-22-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4888-24-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4888-23-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4888-26-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4888-25-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4888-2-0x00000000022A0000-0x0000000002300000-memory.dmp

Filesize
384KB

Download
memory/4888-27-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4888-29-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4888-3-0x0000000000400000-0x00000000004FC000-memory.dmp

Filesize
1008KB

Download
memory/4888-30-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4888-6-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/4888-32-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4888-34-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4888-35-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4888-36-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4888-38-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4888-37-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4888-39-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4888-40-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4888-31-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4888-42-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4888-43-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4888-45-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4888-44-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4888-46-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4888-47-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4888-49-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/4888-48-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4888-50-0x0000000002570000-0x0000000002574000-memory.dmp

Filesize
16KB

Download
memory/4888-51-0x0000000002570000-0x0000000002574000-memory.dmp

Filesize
16KB

Download
memory/4888-52-0x0000000002570000-0x0000000002574000-memory.dmp

Filesize
16KB

Download
memory/4888-53-0x0000000002570000-0x0000000002574000-memory.dmp

Filesize
16KB

Download
memory/4888-54-0x0000000002570000-0x0000000002574000-memory.dmp

Filesize
16KB

Download
memory/4888-55-0x0000000002570000-0x0000000002574000-memory.dmp

Filesize
16KB

Download
memory/4888-56-0x0000000002570000-0x0000000002574000-memory.dmp

Filesize
16KB

Download
memory/4888-60-0x0000000000400000-0x00000000004FC000-memory.dmp

Filesize
1008KB

Download
memory/4888-65-0x0000000000400000-0x00000000004FC000-memory.dmp

Filesize
1008KB

Download
memory/4888-1-0x0000000000400000-0x00000000004FC000-memory.dmp

Filesize
1008KB

Download
memory/4888-0-0x0000000000400000-0x00000000004FC000-memory.dmp

Filesize
1008KB

Download
memory/4888-66-0x00000000022A0000-0x0000000002300000-memory.dmp

Filesize
384KB

Download