Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
05-01-2024 23:33
Static task
static1
Behavioral task
behavioral1
Sample
44b5e8ba48463ac53a256a40abdbbd80.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
44b5e8ba48463ac53a256a40abdbbd80.exe
Resource
win10v2004-20231222-en
General
-
Target
44b5e8ba48463ac53a256a40abdbbd80.exe
-
Size
314KB
-
MD5
44b5e8ba48463ac53a256a40abdbbd80
-
SHA1
05fe0a0428da1f45d9592d0104ee68a37d3be11a
-
SHA256
94d2559879eec79d9ffb68526edcda04106f486b9044fdc92bdb02ca88adfbc0
-
SHA512
40764b7d627eedfc1a9517ea7a1ec548cd0c272ad64121b7d71d4579581f1775c636ed6e46c410f578a41b834b8a06942a58a4d7609513a1feaf2e875f08be64
-
SSDEEP
6144:6/TGarVjnOhA1WxDLe6gvjmgw3vdZTPa7KzIU/wgPm:6/1rVkA1WDLe6W3CdBiOzIUi
Malware Config
Signatures
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
44b5e8ba48463ac53a256a40abdbbd80.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 44b5e8ba48463ac53a256a40abdbbd80.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 44b5e8ba48463ac53a256a40abdbbd80.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
44b5e8ba48463ac53a256a40abdbbd80.exedescription pid process target process PID 2852 set thread context of 4916 2852 44b5e8ba48463ac53a256a40abdbbd80.exe 44b5e8ba48463ac53a256a40abdbbd80.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
44b5e8ba48463ac53a256a40abdbbd80.exepid process 4916 44b5e8ba48463ac53a256a40abdbbd80.exe 4916 44b5e8ba48463ac53a256a40abdbbd80.exe 4916 44b5e8ba48463ac53a256a40abdbbd80.exe 4916 44b5e8ba48463ac53a256a40abdbbd80.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
44b5e8ba48463ac53a256a40abdbbd80.exepid process 2852 44b5e8ba48463ac53a256a40abdbbd80.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
44b5e8ba48463ac53a256a40abdbbd80.exedescription pid process target process PID 2852 wrote to memory of 4916 2852 44b5e8ba48463ac53a256a40abdbbd80.exe 44b5e8ba48463ac53a256a40abdbbd80.exe PID 2852 wrote to memory of 4916 2852 44b5e8ba48463ac53a256a40abdbbd80.exe 44b5e8ba48463ac53a256a40abdbbd80.exe PID 2852 wrote to memory of 4916 2852 44b5e8ba48463ac53a256a40abdbbd80.exe 44b5e8ba48463ac53a256a40abdbbd80.exe PID 2852 wrote to memory of 4916 2852 44b5e8ba48463ac53a256a40abdbbd80.exe 44b5e8ba48463ac53a256a40abdbbd80.exe PID 2852 wrote to memory of 4916 2852 44b5e8ba48463ac53a256a40abdbbd80.exe 44b5e8ba48463ac53a256a40abdbbd80.exe PID 2852 wrote to memory of 4916 2852 44b5e8ba48463ac53a256a40abdbbd80.exe 44b5e8ba48463ac53a256a40abdbbd80.exe PID 2852 wrote to memory of 4916 2852 44b5e8ba48463ac53a256a40abdbbd80.exe 44b5e8ba48463ac53a256a40abdbbd80.exe PID 2852 wrote to memory of 4916 2852 44b5e8ba48463ac53a256a40abdbbd80.exe 44b5e8ba48463ac53a256a40abdbbd80.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\44b5e8ba48463ac53a256a40abdbbd80.exe"C:\Users\Admin\AppData\Local\Temp\44b5e8ba48463ac53a256a40abdbbd80.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\44b5e8ba48463ac53a256a40abdbbd80.exeC:\Users\Admin\AppData\Local\Temp\44b5e8ba48463ac53a256a40abdbbd80.exe2⤵
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4916-3-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/4916-5-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/4916-4-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/4916-2-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/4916-6-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB