2da9ce98924fa38beafeeaee10b5a529063b9027920b0b8d3846c41f0e2dee23

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 12:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9bb0b89640b6d6738d86cdbb6d127153.exe
Size

152KB
MD5

9bb0b89640b6d6738d86cdbb6d127153
SHA1

ca524126d6af76681d94bbb79230bdc411a6ae02
SHA256

2da9ce98924fa38beafeeaee10b5a529063b9027920b0b8d3846c41f0e2dee23
SHA512

e2087e9f9c5e5b07881b4a92bd5b2b50cbe28d0e4bdd155da1b18cff07bf7ab979dfbdaafd4d05a6bbbb4497532baca9c8e3c7a8d79a6b8d6d75ad634f014b04
SSDEEP

1536:sy/8RZ865JlPRUqrO5Igkb4Jsy91bI6Le:syko8+qyu/b4JsU1kOe

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 3044 set thread context of 1876	3044	9bb0b89640b6d6738d86cdbb6d127153.exe	28
PID 3044 set thread context of 0	3044	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 3044 set thread context of 0	3044	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 3044 set thread context of 0	3044	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 3044 set thread context of 0	3044	9bb0b89640b6d6738d86cdbb6d127153.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1876	9bb0b89640b6d6738d86cdbb6d127153.exe
1876	9bb0b89640b6d6738d86cdbb6d127153.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3044	9bb0b89640b6d6738d86cdbb6d127153.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 1876	3044	9bb0b89640b6d6738d86cdbb6d127153.exe	28
PID 3044 wrote to memory of 1876	3044	9bb0b89640b6d6738d86cdbb6d127153.exe	28
PID 3044 wrote to memory of 1876	3044	9bb0b89640b6d6738d86cdbb6d127153.exe	28
PID 3044 wrote to memory of 1876	3044	9bb0b89640b6d6738d86cdbb6d127153.exe	28
PID 3044 wrote to memory of 1876	3044	9bb0b89640b6d6738d86cdbb6d127153.exe	28
PID 3044 wrote to memory of 1876	3044	9bb0b89640b6d6738d86cdbb6d127153.exe	28
PID 3044 wrote to memory of 1876	3044	9bb0b89640b6d6738d86cdbb6d127153.exe	28
PID 3044 wrote to memory of 1876	3044	9bb0b89640b6d6738d86cdbb6d127153.exe	28
PID 3044 wrote to memory of 0	3044	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 3044 wrote to memory of 0	3044	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 3044 wrote to memory of 0	3044	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 3044 wrote to memory of 0	3044	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 3044 wrote to memory of 0	3044	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 3044 wrote to memory of 0	3044	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 3044 wrote to memory of 0	3044	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 3044 wrote to memory of 0	3044	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 3044 wrote to memory of 0	3044	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 3044 wrote to memory of 0	3044	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 3044 wrote to memory of 0	3044	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 3044 wrote to memory of 0	3044	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 3044 wrote to memory of 0	3044	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 3044 wrote to memory of 0	3044	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 3044 wrote to memory of 0	3044	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 3044 wrote to memory of 0	3044	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 1876 wrote to memory of 1272	1876	9bb0b89640b6d6738d86cdbb6d127153.exe	15
PID 1876 wrote to memory of 1272	1876	9bb0b89640b6d6738d86cdbb6d127153.exe	15
PID 1876 wrote to memory of 1272	1876	9bb0b89640b6d6738d86cdbb6d127153.exe	15
PID 1876 wrote to memory of 1272	1876	9bb0b89640b6d6738d86cdbb6d127153.exe	15

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1272
- C:\Users\Admin\AppData\Local\Temp\9bb0b89640b6d6738d86cdbb6d127153.exe
  "C:\Users\Admin\AppData\Local\Temp\9bb0b89640b6d6738d86cdbb6d127153.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Users\Admin\AppData\Local\Temp\9bb0b89640b6d6738d86cdbb6d127153.exe
    "C:\Users\Admin\AppData\Local\Temp\9bb0b89640b6d6738d86cdbb6d127153.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1272-7-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1272-11-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1876-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1876-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1876-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1876-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1876-10-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download