Analysis
-
max time kernel
144s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
08/01/2024, 14:06
Static task
static1
Behavioral task
behavioral1
Sample
97c2d5b8641875634156368989ff410bb6b5cab67c2c5430b73cb47d51982012.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
97c2d5b8641875634156368989ff410bb6b5cab67c2c5430b73cb47d51982012.exe
Resource
win10v2004-20231222-en
General
-
Target
97c2d5b8641875634156368989ff410bb6b5cab67c2c5430b73cb47d51982012.exe
-
Size
1.4MB
-
MD5
2f0d1effca8e06f489035a1e1facc192
-
SHA1
fd96f6c801e4791c82d2c7cf44c7a829d95a946b
-
SHA256
97c2d5b8641875634156368989ff410bb6b5cab67c2c5430b73cb47d51982012
-
SHA512
a8deb4a624d5d83c1c5aa98aa986dd9ae0b261a9e57066853e2187fc9ea25308e1d1e072efe80d76e569ff93734a75447566c9a31f5b0536fae532383075166f
-
SSDEEP
24576:Y4U6dqpfTTGiyfhy584ihQuL87Etqq6vOSpd57vwvN4j6Ii3Vke3u:Y4XwppyU+87jd57v243akj
Malware Config
Signatures
-
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2328 set thread context of 1672 2328 97c2d5b8641875634156368989ff410bb6b5cab67c2c5430b73cb47d51982012.exe 28 PID 1672 set thread context of 1356 1672 calc.exe 6 PID 1672 set thread context of 2576 1672 calc.exe 29 PID 2576 set thread context of 1356 2576 wextract.exe 6 -
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 1672 calc.exe 1672 calc.exe 1672 calc.exe 1672 calc.exe 1672 calc.exe 1672 calc.exe 1672 calc.exe 1672 calc.exe 2576 wextract.exe 2576 wextract.exe 2576 wextract.exe 2576 wextract.exe 2576 wextract.exe 2576 wextract.exe 2576 wextract.exe 2576 wextract.exe 2576 wextract.exe 2576 wextract.exe 2576 wextract.exe 2576 wextract.exe 2576 wextract.exe 2576 wextract.exe 2576 wextract.exe 2576 wextract.exe 2576 wextract.exe 2576 wextract.exe 2576 wextract.exe 2576 wextract.exe 2576 wextract.exe 2576 wextract.exe 2576 wextract.exe 2576 wextract.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1672 calc.exe 1356 Explorer.EXE 1356 Explorer.EXE 2576 wextract.exe 2576 wextract.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2328 wrote to memory of 1672 2328 97c2d5b8641875634156368989ff410bb6b5cab67c2c5430b73cb47d51982012.exe 28 PID 2328 wrote to memory of 1672 2328 97c2d5b8641875634156368989ff410bb6b5cab67c2c5430b73cb47d51982012.exe 28 PID 2328 wrote to memory of 1672 2328 97c2d5b8641875634156368989ff410bb6b5cab67c2c5430b73cb47d51982012.exe 28 PID 2328 wrote to memory of 1672 2328 97c2d5b8641875634156368989ff410bb6b5cab67c2c5430b73cb47d51982012.exe 28 PID 2328 wrote to memory of 1672 2328 97c2d5b8641875634156368989ff410bb6b5cab67c2c5430b73cb47d51982012.exe 28 PID 2328 wrote to memory of 1672 2328 97c2d5b8641875634156368989ff410bb6b5cab67c2c5430b73cb47d51982012.exe 28 PID 2328 wrote to memory of 1672 2328 97c2d5b8641875634156368989ff410bb6b5cab67c2c5430b73cb47d51982012.exe 28 PID 1356 wrote to memory of 2576 1356 Explorer.EXE 29 PID 1356 wrote to memory of 2576 1356 Explorer.EXE 29 PID 1356 wrote to memory of 2576 1356 Explorer.EXE 29 PID 1356 wrote to memory of 2576 1356 Explorer.EXE 29 PID 1356 wrote to memory of 2576 1356 Explorer.EXE 29 PID 1356 wrote to memory of 2576 1356 Explorer.EXE 29 PID 1356 wrote to memory of 2576 1356 Explorer.EXE 29
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\97c2d5b8641875634156368989ff410bb6b5cab67c2c5430b73cb47d51982012.exe"C:\Users\Admin\AppData\Local\Temp\97c2d5b8641875634156368989ff410bb6b5cab67c2c5430b73cb47d51982012.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SYSWOW64\calc.exe"C:\Windows\SYSWOW64\calc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1672
-
-
-
C:\Windows\SysWOW64\wextract.exe"C:\Windows\SysWOW64\wextract.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2576
-