Analysis

  • max time kernel
    138s
  • max time network
    51s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/01/2024, 19:37

General

  • Target

    a83dd75d61102086fcddcbe2b48f644b.exe

  • Size

    96KB

  • MD5

    a83dd75d61102086fcddcbe2b48f644b

  • SHA1

    50e77ec55243e76e2ceaddf5930712f1962c235d

  • SHA256

    16f701f6662d98652f659d35371e60765a64035a81f1a92a1c0fdc2e67d3af69

  • SHA512

    509b80c66264dcb15b9b4b60e93d52d52c2b79fce94da1a3a010f0c040d15a049e5830bbd2341ec6875db1666e32d79b606bf38df5f9f2ace8a3af6b2c3218cc

  • SSDEEP

    768:IBd4Xon6LgLa1fmTZTPXqI5zUDO6SaQIKhAQ52tYQ4NBKJeYjQTEVwbK:I3DLaRmF7XXB6SapwAxtrPsECm

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a83dd75d61102086fcddcbe2b48f644b.exe
    "C:\Users\Admin\AppData\Local\Temp\a83dd75d61102086fcddcbe2b48f644b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1472
    • C:\Users\Admin\AppData\Local\Temp\a83dd75d61102086fcddcbe2b48f644b.exe
      "C:\Users\Admin\AppData\Local\Temp\a83dd75d61102086fcddcbe2b48f644b.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2768
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        3⤵
          PID:4840

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1472-0-0x0000000000400000-0x000000000041D000-memory.dmp

            Filesize

            116KB

          • memory/1472-3-0x0000000000400000-0x000000000041D000-memory.dmp

            Filesize

            116KB

          • memory/2768-5-0x0000000000400000-0x0000000000415000-memory.dmp

            Filesize

            84KB

          • memory/2768-4-0x0000000000400000-0x0000000000415000-memory.dmp

            Filesize

            84KB

          • memory/2768-1-0x0000000000400000-0x0000000000415000-memory.dmp

            Filesize

            84KB

          • memory/2768-7-0x0000000000400000-0x0000000000415000-memory.dmp

            Filesize

            84KB

          • memory/2768-9-0x0000000077BC2000-0x0000000077BC3000-memory.dmp

            Filesize

            4KB

          • memory/2768-6-0x0000000077BC2000-0x0000000077BC3000-memory.dmp

            Filesize

            4KB

          • memory/4840-8-0x00007FF76C350000-0x00007FF76C7ED000-memory.dmp

            Filesize

            4.6MB