880f63ff66c4ff99951172543e5323318832a3cef3f61530c19311a8e84b6f5b

General

Target

7097231557184e207cf113bf5910368c.exe
Size

217KB
MD5

7097231557184e207cf113bf5910368c
SHA1

65da54019f144a6f0dc1f2a110f67048af0e40fb
SHA256

880f63ff66c4ff99951172543e5323318832a3cef3f61530c19311a8e84b6f5b
SHA512

241714c0b6199acf0362178f3ae1cd2e2606ce539dda7ce5e646c154227b36b59a4d746d50dc211f7163ac38b31a2587c8cc9eb0e70e7bfaa9f0f717bce26715
SSDEEP

3072:bnASUq6bJLRAoHXQlWjhe+7Cn2lMw+EDtP/YrP6f0IT+ktQnvD:zV+bJLRLuYhp+nCMw+Ctnhf0L8KD

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1656 set thread context of 3024	1656	7097231557184e207cf113bf5910368c.exe	28
PID 3024 set thread context of 2192	3024	7097231557184e207cf113bf5910368c.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2192	7097231557184e207cf113bf5910368c.exe
2192	7097231557184e207cf113bf5910368c.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1656	7097231557184e207cf113bf5910368c.exe
3024	7097231557184e207cf113bf5910368c.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 3024	1656	7097231557184e207cf113bf5910368c.exe	28
PID 1656 wrote to memory of 3024	1656	7097231557184e207cf113bf5910368c.exe	28
PID 1656 wrote to memory of 3024	1656	7097231557184e207cf113bf5910368c.exe	28
PID 1656 wrote to memory of 3024	1656	7097231557184e207cf113bf5910368c.exe	28
PID 1656 wrote to memory of 3024	1656	7097231557184e207cf113bf5910368c.exe	28
PID 1656 wrote to memory of 3024	1656	7097231557184e207cf113bf5910368c.exe	28
PID 1656 wrote to memory of 3024	1656	7097231557184e207cf113bf5910368c.exe	28
PID 1656 wrote to memory of 3024	1656	7097231557184e207cf113bf5910368c.exe	28
PID 1656 wrote to memory of 3024	1656	7097231557184e207cf113bf5910368c.exe	28
PID 3024 wrote to memory of 2192	3024	7097231557184e207cf113bf5910368c.exe	29
PID 3024 wrote to memory of 2192	3024	7097231557184e207cf113bf5910368c.exe	29
PID 3024 wrote to memory of 2192	3024	7097231557184e207cf113bf5910368c.exe	29
PID 3024 wrote to memory of 2192	3024	7097231557184e207cf113bf5910368c.exe	29
PID 3024 wrote to memory of 2192	3024	7097231557184e207cf113bf5910368c.exe	29
PID 3024 wrote to memory of 2192	3024	7097231557184e207cf113bf5910368c.exe	29
PID 3024 wrote to memory of 2192	3024	7097231557184e207cf113bf5910368c.exe	29
PID 3024 wrote to memory of 2192	3024	7097231557184e207cf113bf5910368c.exe	29
PID 2192 wrote to memory of 1368	2192	7097231557184e207cf113bf5910368c.exe	18
PID 2192 wrote to memory of 1368	2192	7097231557184e207cf113bf5910368c.exe	18
PID 2192 wrote to memory of 1368	2192	7097231557184e207cf113bf5910368c.exe	18
PID 2192 wrote to memory of 1368	2192	7097231557184e207cf113bf5910368c.exe	18

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1368
- C:\Users\Admin\AppData\Local\Temp\7097231557184e207cf113bf5910368c.exe
  "C:\Users\Admin\AppData\Local\Temp\7097231557184e207cf113bf5910368c.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Users\Admin\AppData\Local\Temp\7097231557184e207cf113bf5910368c.exe
    C:\Users\Admin\AppData\Local\Temp\7097231557184e207cf113bf5910368c.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3024
  - - C:\Users\Admin\AppData\Local\Temp\7097231557184e207cf113bf5910368c.exe
      C:\Users\Admin\AppData\Local\Temp\7097231557184e207cf113bf5910368c.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-27-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1368-31-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1656-4-0x00000000002C0000-0x00000000002D9000-memory.dmp

Filesize
100KB

Download
memory/1656-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1656-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2192-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2192-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2192-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2192-18-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2192-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2192-40-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2192-24-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2192-30-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2192-25-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3024-6-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3024-19-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3024-21-0x00000000001C0000-0x00000000001D9000-memory.dmp

Filesize
100KB

Download
memory/3024-3-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads