12d75dff1ceea55e1b50eee579aac166a6c6ce4e5361ca79983be43db8b72a28

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b9efa95c7f77bb46136ec99e06d3c1c.exe
Size

138KB
MD5

3b9efa95c7f77bb46136ec99e06d3c1c
SHA1

bb2636353bb3879b2d7415c99badf1590d67e0d7
SHA256

12d75dff1ceea55e1b50eee579aac166a6c6ce4e5361ca79983be43db8b72a28
SHA512

daaa8d757927f1ad6ad72a3ee69e907cddc9302c7153f8faa3fdd2f1c7ffc270ff53f1d1d755eda9ef4db61f5cb641a89d53eb87c5aa60956d81acea7514f245
SSDEEP

3072:VXkExHBa4N41X+p1bS+HCRRwoynCrJdNymkuV0kW:uExHBa4Sup1b1CVnHNBY9

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2108 set thread context of 1048	2108	3b9efa95c7f77bb46136ec99e06d3c1c.exe	18
PID 1048 set thread context of 2448	1048	3b9efa95c7f77bb46136ec99e06d3c1c.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2448	3b9efa95c7f77bb46136ec99e06d3c1c.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2108	3b9efa95c7f77bb46136ec99e06d3c1c.exe
1048	3b9efa95c7f77bb46136ec99e06d3c1c.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 1048	2108	3b9efa95c7f77bb46136ec99e06d3c1c.exe	18
PID 2108 wrote to memory of 1048	2108	3b9efa95c7f77bb46136ec99e06d3c1c.exe	18
PID 2108 wrote to memory of 1048	2108	3b9efa95c7f77bb46136ec99e06d3c1c.exe	18
PID 2108 wrote to memory of 1048	2108	3b9efa95c7f77bb46136ec99e06d3c1c.exe	18
PID 2108 wrote to memory of 1048	2108	3b9efa95c7f77bb46136ec99e06d3c1c.exe	18
PID 2108 wrote to memory of 1048	2108	3b9efa95c7f77bb46136ec99e06d3c1c.exe	18
PID 2108 wrote to memory of 1048	2108	3b9efa95c7f77bb46136ec99e06d3c1c.exe	18
PID 2108 wrote to memory of 1048	2108	3b9efa95c7f77bb46136ec99e06d3c1c.exe	18
PID 1048 wrote to memory of 2448	1048	3b9efa95c7f77bb46136ec99e06d3c1c.exe	29
PID 1048 wrote to memory of 2448	1048	3b9efa95c7f77bb46136ec99e06d3c1c.exe	29
PID 1048 wrote to memory of 2448	1048	3b9efa95c7f77bb46136ec99e06d3c1c.exe	29
PID 1048 wrote to memory of 2448	1048	3b9efa95c7f77bb46136ec99e06d3c1c.exe	29
PID 1048 wrote to memory of 2448	1048	3b9efa95c7f77bb46136ec99e06d3c1c.exe	29
PID 1048 wrote to memory of 2448	1048	3b9efa95c7f77bb46136ec99e06d3c1c.exe	29
PID 1048 wrote to memory of 2448	1048	3b9efa95c7f77bb46136ec99e06d3c1c.exe	29
PID 1048 wrote to memory of 2448	1048	3b9efa95c7f77bb46136ec99e06d3c1c.exe	29
PID 2448 wrote to memory of 1200	2448	3b9efa95c7f77bb46136ec99e06d3c1c.exe	14
PID 2448 wrote to memory of 1200	2448	3b9efa95c7f77bb46136ec99e06d3c1c.exe	14
PID 2448 wrote to memory of 1200	2448	3b9efa95c7f77bb46136ec99e06d3c1c.exe	14
PID 2448 wrote to memory of 1200	2448	3b9efa95c7f77bb46136ec99e06d3c1c.exe	14
PID 2448 wrote to memory of 1200	2448	3b9efa95c7f77bb46136ec99e06d3c1c.exe	14
PID 2448 wrote to memory of 1200	2448	3b9efa95c7f77bb46136ec99e06d3c1c.exe	14

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\3b9efa95c7f77bb46136ec99e06d3c1c.exe
  "C:\Users\Admin\AppData\Local\Temp\3b9efa95c7f77bb46136ec99e06d3c1c.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Users\Admin\AppData\Local\Temp\3b9efa95c7f77bb46136ec99e06d3c1c.exe
    C:\Users\Admin\AppData\Local\Temp\3b9efa95c7f77bb46136ec99e06d3c1c.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1048
  - - C:\Users\Admin\AppData\Local\Temp\3b9efa95c7f77bb46136ec99e06d3c1c.exe
      C:\Users\Admin\AppData\Local\Temp\3b9efa95c7f77bb46136ec99e06d3c1c.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1048-27-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1048-14-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1048-10-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1048-6-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1048-4-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1048-2-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1048-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1200-39-0x000000007EFC0000-0x000000007EFC6000-memory.dmp

Filesize
24KB

Download
memory/1200-31-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Filesize
4KB

Download
memory/2448-34-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2448-35-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2448-30-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2448-23-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2448-21-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2448-19-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2448-17-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download