c6472d8927ae38ba6700c04e577b90b85c14746e34b79b2f69e9c6da2a363ecc

Analysis

max time kernel
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 11:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

69cb709aea74275d0347628557f90e8b.exe
Size

284KB
MD5

69cb709aea74275d0347628557f90e8b
SHA1

5a9d718ec83f94648521432cb0bd8d9ff2ea1bf0
SHA256

c6472d8927ae38ba6700c04e577b90b85c14746e34b79b2f69e9c6da2a363ecc
SHA512

9e6718dc16fe3e039373c423b855960bcab239340d98542ae4b7922c1967aa71b7577723d721a97da6c9bde82de240b2795bd73d861e97a0a3fb3fee8cbcbf2c
SSDEEP

6144:wzwbbUI/nEgNBoQw/SZY1mUhnExnuclP9pPXZwaxFbR0L:cq/n10KaZIuAP95XLaL

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3144 set thread context of 4248	3144	69cb709aea74275d0347628557f90e8b.exe	19

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4248	69cb709aea74275d0347628557f90e8b.exe
4248	69cb709aea74275d0347628557f90e8b.exe
4248	69cb709aea74275d0347628557f90e8b.exe
4248	69cb709aea74275d0347628557f90e8b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3144	69cb709aea74275d0347628557f90e8b.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 4248	3144	69cb709aea74275d0347628557f90e8b.exe	19
PID 3144 wrote to memory of 4248	3144	69cb709aea74275d0347628557f90e8b.exe	19
PID 3144 wrote to memory of 4248	3144	69cb709aea74275d0347628557f90e8b.exe	19
PID 3144 wrote to memory of 4248	3144	69cb709aea74275d0347628557f90e8b.exe	19
PID 3144 wrote to memory of 4248	3144	69cb709aea74275d0347628557f90e8b.exe	19
PID 3144 wrote to memory of 4248	3144	69cb709aea74275d0347628557f90e8b.exe	19
PID 3144 wrote to memory of 4248	3144	69cb709aea74275d0347628557f90e8b.exe	19
PID 3144 wrote to memory of 4248	3144	69cb709aea74275d0347628557f90e8b.exe	19
PID 3144 wrote to memory of 4248	3144	69cb709aea74275d0347628557f90e8b.exe	19
PID 4248 wrote to memory of 3408	4248	69cb709aea74275d0347628557f90e8b.exe	49
PID 4248 wrote to memory of 3408	4248	69cb709aea74275d0347628557f90e8b.exe	49
PID 4248 wrote to memory of 3408	4248	69cb709aea74275d0347628557f90e8b.exe	49
PID 4248 wrote to memory of 3408	4248	69cb709aea74275d0347628557f90e8b.exe	49

C:\Users\Admin\AppData\Local\Temp\69cb709aea74275d0347628557f90e8b.exe
"C:\Users\Admin\AppData\Local\Temp\69cb709aea74275d0347628557f90e8b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Users\Admin\AppData\Local\Temp\69cb709aea74275d0347628557f90e8b.exe
  C:\Users\Admin\AppData\Local\Temp\69cb709aea74275d0347628557f90e8b.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4248

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3144-3-0x00000000005D0000-0x00000000005E0000-memory.dmp

Filesize
64KB

Download
memory/3144-10-0x0000000076F63000-0x0000000076F64000-memory.dmp

Filesize
4KB

Download
memory/3144-0-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3144-19-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3144-20-0x0000000000700000-0x0000000000739000-memory.dmp

Filesize
228KB

Download
memory/3144-1-0x00000000005A0000-0x00000000005A4000-memory.dmp

Filesize
16KB

Download
memory/3144-21-0x0000000076BC0000-0x0000000076CB0000-memory.dmp

Filesize
960KB

Download
memory/3144-6-0x0000000002270000-0x0000000002280000-memory.dmp

Filesize
64KB

Download
memory/3144-7-0x0000000000770000-0x0000000000780000-memory.dmp

Filesize
64KB

Download
memory/3144-9-0x0000000076F73000-0x0000000076F74000-memory.dmp

Filesize
4KB

Download
memory/3144-11-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3144-8-0x0000000076BC0000-0x0000000076CB0000-memory.dmp

Filesize
960KB

Download
memory/3144-2-0x0000000000700000-0x0000000000739000-memory.dmp

Filesize
228KB

Download
memory/3144-5-0x0000000076F72000-0x0000000076F73000-memory.dmp

Filesize
4KB

Download
memory/3144-4-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3144-12-0x00000000007C0000-0x00000000007C2000-memory.dmp

Filesize
8KB

Download
memory/3408-23-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3408-24-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/4248-17-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4248-18-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4248-15-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4248-22-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/4248-29-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download