608b1de966e92e52977b61a1851f2b8e9d03f55e19394ff46f3f3a9776ef1fa4

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 07:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98d52e664058d5d0793b4b50f53e79f9.exe
Size

262KB
MD5

98d52e664058d5d0793b4b50f53e79f9
SHA1

1504b65960c955ecce595aa619785034f2528d77
SHA256

608b1de966e92e52977b61a1851f2b8e9d03f55e19394ff46f3f3a9776ef1fa4
SHA512

07287ce7a3bca3bc39e80d27925c19535e5c33eeb641dbc1bc38d85a572b39fccac749f3e6c16c2d67af88fd608fb67ae7b27031c20d9ecc6f7dbed347f8c0b3
SSDEEP

6144:XD3COdsNIPJdosCuCLjSrOqR/sVEyP5X+WUBDxQJxR5I:XDeEJdVCuIYUayhX+W4uxR5I

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1716 set thread context of 2552	1716	98d52e664058d5d0793b4b50f53e79f9.exe	28
PID 2552 set thread context of 2440	2552	98d52e664058d5d0793b4b50f53e79f9.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2440	98d52e664058d5d0793b4b50f53e79f9.exe
2440	98d52e664058d5d0793b4b50f53e79f9.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1716	98d52e664058d5d0793b4b50f53e79f9.exe
2552	98d52e664058d5d0793b4b50f53e79f9.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 2552	1716	98d52e664058d5d0793b4b50f53e79f9.exe	28
PID 1716 wrote to memory of 2552	1716	98d52e664058d5d0793b4b50f53e79f9.exe	28
PID 1716 wrote to memory of 2552	1716	98d52e664058d5d0793b4b50f53e79f9.exe	28
PID 1716 wrote to memory of 2552	1716	98d52e664058d5d0793b4b50f53e79f9.exe	28
PID 1716 wrote to memory of 2552	1716	98d52e664058d5d0793b4b50f53e79f9.exe	28
PID 1716 wrote to memory of 2552	1716	98d52e664058d5d0793b4b50f53e79f9.exe	28
PID 1716 wrote to memory of 2552	1716	98d52e664058d5d0793b4b50f53e79f9.exe	28
PID 1716 wrote to memory of 2552	1716	98d52e664058d5d0793b4b50f53e79f9.exe	28
PID 1716 wrote to memory of 2552	1716	98d52e664058d5d0793b4b50f53e79f9.exe	28
PID 2552 wrote to memory of 2440	2552	98d52e664058d5d0793b4b50f53e79f9.exe	29
PID 2552 wrote to memory of 2440	2552	98d52e664058d5d0793b4b50f53e79f9.exe	29
PID 2552 wrote to memory of 2440	2552	98d52e664058d5d0793b4b50f53e79f9.exe	29
PID 2552 wrote to memory of 2440	2552	98d52e664058d5d0793b4b50f53e79f9.exe	29
PID 2552 wrote to memory of 2440	2552	98d52e664058d5d0793b4b50f53e79f9.exe	29
PID 2552 wrote to memory of 2440	2552	98d52e664058d5d0793b4b50f53e79f9.exe	29
PID 2552 wrote to memory of 2440	2552	98d52e664058d5d0793b4b50f53e79f9.exe	29
PID 2552 wrote to memory of 2440	2552	98d52e664058d5d0793b4b50f53e79f9.exe	29
PID 2440 wrote to memory of 1208	2440	98d52e664058d5d0793b4b50f53e79f9.exe	18
PID 2440 wrote to memory of 1208	2440	98d52e664058d5d0793b4b50f53e79f9.exe	18
PID 2440 wrote to memory of 1208	2440	98d52e664058d5d0793b4b50f53e79f9.exe	18
PID 2440 wrote to memory of 1208	2440	98d52e664058d5d0793b4b50f53e79f9.exe	18

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208
- C:\Users\Admin\AppData\Local\Temp\98d52e664058d5d0793b4b50f53e79f9.exe
  "C:\Users\Admin\AppData\Local\Temp\98d52e664058d5d0793b4b50f53e79f9.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Users\Admin\AppData\Local\Temp\98d52e664058d5d0793b4b50f53e79f9.exe
    C:\Users\Admin\AppData\Local\Temp\98d52e664058d5d0793b4b50f53e79f9.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\Users\Admin\AppData\Local\Temp\98d52e664058d5d0793b4b50f53e79f9.exe
      C:\Users\Admin\AppData\Local\Temp\98d52e664058d5d0793b4b50f53e79f9.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1208-21-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1208-18-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1716-0-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1716-33-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2440-15-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2440-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2440-12-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/2440-16-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2440-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2440-32-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2552-11-0x0000000002540000-0x000000000260C000-memory.dmp

Filesize
816KB

Download
memory/2552-14-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2552-5-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2552-3-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download