8981d1cebb83d756c7d87b02cf3e50a99d2d9174c98b6fa151bb446b64b69dab

Analysis

max time kernel
157s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 16:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7cea6b709fe3de401d58475da420bbe7.exe
Size

172KB
MD5

7cea6b709fe3de401d58475da420bbe7
SHA1

852fa70b08d52e5248ca3e347a74624e51f15986
SHA256

8981d1cebb83d756c7d87b02cf3e50a99d2d9174c98b6fa151bb446b64b69dab
SHA512

e10523609d4b0db250d752184fb670e5404abea7efd56122605292f4321d0b87e0f26b5daa63dfea421014da6f662b5b9d60c917d7741ce439ace1c067aa8f5e
SSDEEP

3072:7Bj0VVESD78ZOKh6DbFRKd60uI/jMQ2nJ3EESDo:7BS9X+QXfKz9/jTpt8

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4968 set thread context of 3664	4968	7cea6b709fe3de401d58475da420bbe7.exe	90

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3664	7cea6b709fe3de401d58475da420bbe7.exe
3664	7cea6b709fe3de401d58475da420bbe7.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4968	7cea6b709fe3de401d58475da420bbe7.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 3664	4968	7cea6b709fe3de401d58475da420bbe7.exe	90
PID 4968 wrote to memory of 3664	4968	7cea6b709fe3de401d58475da420bbe7.exe	90
PID 4968 wrote to memory of 3664	4968	7cea6b709fe3de401d58475da420bbe7.exe	90
PID 4968 wrote to memory of 3664	4968	7cea6b709fe3de401d58475da420bbe7.exe	90
PID 4968 wrote to memory of 3664	4968	7cea6b709fe3de401d58475da420bbe7.exe	90
PID 4968 wrote to memory of 3664	4968	7cea6b709fe3de401d58475da420bbe7.exe	90
PID 4968 wrote to memory of 3664	4968	7cea6b709fe3de401d58475da420bbe7.exe	90
PID 4968 wrote to memory of 3664	4968	7cea6b709fe3de401d58475da420bbe7.exe	90
PID 3664 wrote to memory of 3136	3664	7cea6b709fe3de401d58475da420bbe7.exe	47
PID 3664 wrote to memory of 3136	3664	7cea6b709fe3de401d58475da420bbe7.exe	47
PID 3664 wrote to memory of 3136	3664	7cea6b709fe3de401d58475da420bbe7.exe	47
PID 3664 wrote to memory of 3136	3664	7cea6b709fe3de401d58475da420bbe7.exe	47
PID 3664 wrote to memory of 3136	3664	7cea6b709fe3de401d58475da420bbe7.exe	47

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3136
- C:\Users\Admin\AppData\Local\Temp\7cea6b709fe3de401d58475da420bbe7.exe
  "C:\Users\Admin\AppData\Local\Temp\7cea6b709fe3de401d58475da420bbe7.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Users\Admin\AppData\Local\Temp\7cea6b709fe3de401d58475da420bbe7.exe
    C:\Users\Admin\AppData\Local\Temp\7cea6b709fe3de401d58475da420bbe7.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3664-58-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3664-57-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3664-56-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3664-59-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3664-60-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4968-45-0x0000000002CE0000-0x0000000002CF0000-memory.dmp

Filesize
64KB

Download
memory/4968-7-0x00000000021F0000-0x0000000002200000-memory.dmp

Filesize
64KB

Download
memory/4968-37-0x0000000002C60000-0x0000000002C70000-memory.dmp

Filesize
64KB

Download
memory/4968-1-0x00000000005F0000-0x0000000000600000-memory.dmp

Filesize
64KB

Download
memory/4968-4-0x00000000021C0000-0x00000000021D0000-memory.dmp

Filesize
64KB

Download
memory/4968-5-0x00000000021D0000-0x00000000021E0000-memory.dmp

Filesize
64KB

Download
memory/4968-16-0x00000000022A0000-0x00000000022B0000-memory.dmp

Filesize
64KB

Download
memory/4968-18-0x0000000002A10000-0x0000000002A20000-memory.dmp

Filesize
64KB

Download
memory/4968-17-0x0000000002A00000-0x0000000002A10000-memory.dmp

Filesize
64KB

Download
memory/4968-22-0x0000000002A50000-0x0000000002A60000-memory.dmp

Filesize
64KB

Download
memory/4968-28-0x0000000002BD0000-0x0000000002BE0000-memory.dmp

Filesize
64KB

Download
memory/4968-29-0x0000000002BE0000-0x0000000002BF0000-memory.dmp

Filesize
64KB

Download
memory/4968-27-0x0000000002BB0000-0x0000000002BC0000-memory.dmp

Filesize
64KB

Download
memory/4968-26-0x0000000002BA0000-0x0000000002BB0000-memory.dmp

Filesize
64KB

Download
memory/4968-33-0x0000000002C20000-0x0000000002C30000-memory.dmp

Filesize
64KB

Download
memory/4968-34-0x0000000002C30000-0x0000000002C40000-memory.dmp

Filesize
64KB

Download
memory/4968-36-0x0000000002C50000-0x0000000002C60000-memory.dmp

Filesize
64KB

Download
memory/4968-38-0x0000000002C70000-0x0000000002C80000-memory.dmp

Filesize
64KB

Download
memory/4968-39-0x0000000002C80000-0x0000000002C90000-memory.dmp

Filesize
64KB

Download
memory/4968-40-0x0000000002C90000-0x0000000002CA0000-memory.dmp

Filesize
64KB

Download
memory/4968-41-0x0000000002CA0000-0x0000000002CB0000-memory.dmp

Filesize
64KB

Download
memory/4968-42-0x0000000002CB0000-0x0000000002CC0000-memory.dmp

Filesize
64KB

Download
memory/4968-44-0x0000000002CD0000-0x0000000002CE0000-memory.dmp

Filesize
64KB

Download
memory/4968-0-0x00000000005E0000-0x00000000005F0000-memory.dmp

Filesize
64KB

Download
memory/4968-46-0x0000000002CF0000-0x0000000002D00000-memory.dmp

Filesize
64KB

Download
memory/4968-43-0x0000000002CC0000-0x0000000002CD0000-memory.dmp

Filesize
64KB

Download
memory/4968-2-0x00000000021A0000-0x00000000021B0000-memory.dmp

Filesize
64KB

Download
memory/4968-3-0x00000000021B0000-0x00000000021C0000-memory.dmp

Filesize
64KB

Download
memory/4968-12-0x0000000002260000-0x0000000002270000-memory.dmp

Filesize
64KB

Download
memory/4968-49-0x0000000002D20000-0x0000000002D30000-memory.dmp

Filesize
64KB

Download
memory/4968-35-0x0000000002C40000-0x0000000002C50000-memory.dmp

Filesize
64KB

Download
memory/4968-50-0x0000000002D30000-0x0000000002D40000-memory.dmp

Filesize
64KB

Download
memory/4968-32-0x0000000002C10000-0x0000000002C20000-memory.dmp

Filesize
64KB

Download
memory/4968-31-0x0000000002C00000-0x0000000002C10000-memory.dmp

Filesize
64KB

Download
memory/4968-30-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Filesize
64KB

Download
memory/4968-25-0x0000000002A80000-0x0000000002A90000-memory.dmp

Filesize
64KB

Download
memory/4968-24-0x0000000002A70000-0x0000000002A80000-memory.dmp

Filesize
64KB

Download
memory/4968-23-0x0000000002A60000-0x0000000002A70000-memory.dmp

Filesize
64KB

Download
memory/4968-21-0x0000000002A40000-0x0000000002A50000-memory.dmp

Filesize
64KB

Download
memory/4968-20-0x0000000002A30000-0x0000000002A40000-memory.dmp

Filesize
64KB

Download
memory/4968-19-0x0000000002A20000-0x0000000002A30000-memory.dmp

Filesize
64KB

Download
memory/4968-15-0x0000000002290000-0x00000000022A0000-memory.dmp

Filesize
64KB

Download
memory/4968-14-0x0000000002280000-0x0000000002290000-memory.dmp

Filesize
64KB

Download
memory/4968-13-0x0000000002270000-0x0000000002280000-memory.dmp

Filesize
64KB

Download
memory/4968-48-0x0000000002D10000-0x0000000002D20000-memory.dmp

Filesize
64KB

Download
memory/4968-11-0x0000000002250000-0x0000000002260000-memory.dmp

Filesize
64KB

Download
memory/4968-10-0x0000000002240000-0x0000000002250000-memory.dmp

Filesize
64KB

Download
memory/4968-9-0x0000000002220000-0x0000000002230000-memory.dmp

Filesize
64KB

Download
memory/4968-8-0x0000000002210000-0x0000000002220000-memory.dmp

Filesize
64KB

Download
memory/4968-47-0x0000000002D00000-0x0000000002D10000-memory.dmp

Filesize
64KB

Download
memory/4968-6-0x00000000021E0000-0x00000000021F0000-memory.dmp

Filesize
64KB

Download
memory/4968-51-0x0000000002D40000-0x0000000002D50000-memory.dmp

Filesize
64KB

Download
memory/4968-52-0x0000000002D50000-0x0000000002D60000-memory.dmp

Filesize
64KB

Download
memory/4968-53-0x0000000002D60000-0x0000000002D70000-memory.dmp

Filesize
64KB

Download