Analysis
-
max time kernel
91s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
18/01/2024, 10:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
651b90d51952bc8608b66a35b11c4fbf.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
General
-
Target
651b90d51952bc8608b66a35b11c4fbf.exe
-
Size
57KB
-
MD5
651b90d51952bc8608b66a35b11c4fbf
-
SHA1
be0740838563ee19e49f80d1e5ac9f132059a3d9
-
SHA256
bfe5341ffb28bc85996242f1dd79e6430ea963e1c7aea30475d81f73697378eb
-
SHA512
653106129520c41debdcb8d91b8bdadd96924524448b5ca7b13589dfbb283fc2d8e90fe5c54a5b3feba603ac8ba52b8313341d0e27a86d66d2136e1a2567d24c
-
SSDEEP
768:aASW7s4H4GqXmI+efbvyortUngfuzKw8BZQ:aq4Oefbqs1fuX
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2608-1-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/2608-3-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/2608-4-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/2608-5-0x0000000000400000-0x000000000040A000-memory.dmp upx -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 651b90d51952bc8608b66a35b11c4fbf.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2568 set thread context of 2608 2568 651b90d51952bc8608b66a35b11c4fbf.exe 90 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2608 651b90d51952bc8608b66a35b11c4fbf.exe 2608 651b90d51952bc8608b66a35b11c4fbf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2568 wrote to memory of 2608 2568 651b90d51952bc8608b66a35b11c4fbf.exe 90 PID 2568 wrote to memory of 2608 2568 651b90d51952bc8608b66a35b11c4fbf.exe 90 PID 2568 wrote to memory of 2608 2568 651b90d51952bc8608b66a35b11c4fbf.exe 90 PID 2568 wrote to memory of 2608 2568 651b90d51952bc8608b66a35b11c4fbf.exe 90 PID 2568 wrote to memory of 2608 2568 651b90d51952bc8608b66a35b11c4fbf.exe 90 PID 2568 wrote to memory of 2608 2568 651b90d51952bc8608b66a35b11c4fbf.exe 90 PID 2568 wrote to memory of 2608 2568 651b90d51952bc8608b66a35b11c4fbf.exe 90 PID 2568 wrote to memory of 2608 2568 651b90d51952bc8608b66a35b11c4fbf.exe 90 PID 2568 wrote to memory of 2608 2568 651b90d51952bc8608b66a35b11c4fbf.exe 90 PID 2568 wrote to memory of 2608 2568 651b90d51952bc8608b66a35b11c4fbf.exe 90 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44 PID 2608 wrote to memory of 3496 2608 651b90d51952bc8608b66a35b11c4fbf.exe 44
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\651b90d51952bc8608b66a35b11c4fbf.exe"C:\Users\Admin\AppData\Local\Temp\651b90d51952bc8608b66a35b11c4fbf.exe"2⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\651b90d51952bc8608b66a35b11c4fbf.exe"C:\Users\Admin\AppData\Local\Temp\651b90d51952bc8608b66a35b11c4fbf.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2608
-
-