Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 11:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6a25256d6c8cd5430ba58d164b14477f.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
6a25256d6c8cd5430ba58d164b14477f.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
6a25256d6c8cd5430ba58d164b14477f.exe
-
Size
368KB
-
MD5
6a25256d6c8cd5430ba58d164b14477f
-
SHA1
cb623bbe3ec2913463264f6ee718cbea5950e9be
-
SHA256
e14e0df3f1b5fc6f7f644ee8ca5a7a34f4a6358592bfa1b10a372a207783fd93
-
SHA512
f2a5b30efd9c8a84e8d9ac504ba893d12b468c60d22c78eedd895d471203ade2c76b47dde11bdc2b43b84606f34e40f156cb8cb7b66e87aa127f761b4de4fde0
-
SSDEEP
6144:orttfvmeTLZ7KYkTzlGz9gOUb2GBqoOkR6loMnKXAOjZNZpNugRQVLK4Kzkl:u1J7K/lGRgOUqmq9kR6lhKXPNZpAesl
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5064 set thread context of 4544 5064 6a25256d6c8cd5430ba58d164b14477f.exe 18 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe 4544 6a25256d6c8cd5430ba58d164b14477f.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5064 6a25256d6c8cd5430ba58d164b14477f.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5064 wrote to memory of 4544 5064 6a25256d6c8cd5430ba58d164b14477f.exe 18 PID 5064 wrote to memory of 4544 5064 6a25256d6c8cd5430ba58d164b14477f.exe 18 PID 5064 wrote to memory of 4544 5064 6a25256d6c8cd5430ba58d164b14477f.exe 18 PID 5064 wrote to memory of 4544 5064 6a25256d6c8cd5430ba58d164b14477f.exe 18 PID 5064 wrote to memory of 4544 5064 6a25256d6c8cd5430ba58d164b14477f.exe 18 PID 5064 wrote to memory of 4544 5064 6a25256d6c8cd5430ba58d164b14477f.exe 18 PID 5064 wrote to memory of 4544 5064 6a25256d6c8cd5430ba58d164b14477f.exe 18 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49 PID 4544 wrote to memory of 3520 4544 6a25256d6c8cd5430ba58d164b14477f.exe 49
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a25256d6c8cd5430ba58d164b14477f.exe"C:\Users\Admin\AppData\Local\Temp\6a25256d6c8cd5430ba58d164b14477f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\6a25256d6c8cd5430ba58d164b14477f.exeC:\Users\Admin\AppData\Local\Temp\6a25256d6c8cd5430ba58d164b14477f.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4544
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3520