2da9ce98924fa38beafeeaee10b5a529063b9027920b0b8d3846c41f0e2dee23

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 12:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9bb0b89640b6d6738d86cdbb6d127153.exe
Size

152KB
MD5

9bb0b89640b6d6738d86cdbb6d127153
SHA1

ca524126d6af76681d94bbb79230bdc411a6ae02
SHA256

2da9ce98924fa38beafeeaee10b5a529063b9027920b0b8d3846c41f0e2dee23
SHA512

e2087e9f9c5e5b07881b4a92bd5b2b50cbe28d0e4bdd155da1b18cff07bf7ab979dfbdaafd4d05a6bbbb4497532baca9c8e3c7a8d79a6b8d6d75ad634f014b04
SSDEEP

1536:sy/8RZ865JlPRUqrO5Igkb4Jsy91bI6Le:syko8+qyu/b4JsU1kOe

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2708 set thread context of 3916	2708	9bb0b89640b6d6738d86cdbb6d127153.exe	84
PID 2708 set thread context of 0	2708	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 2708 set thread context of 0	2708	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 2708 set thread context of 0	2708	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 2708 set thread context of 0	2708	9bb0b89640b6d6738d86cdbb6d127153.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3916	9bb0b89640b6d6738d86cdbb6d127153.exe
3916	9bb0b89640b6d6738d86cdbb6d127153.exe
3916	9bb0b89640b6d6738d86cdbb6d127153.exe
3916	9bb0b89640b6d6738d86cdbb6d127153.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2708	9bb0b89640b6d6738d86cdbb6d127153.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 3916	2708	9bb0b89640b6d6738d86cdbb6d127153.exe	84
PID 2708 wrote to memory of 3916	2708	9bb0b89640b6d6738d86cdbb6d127153.exe	84
PID 2708 wrote to memory of 3916	2708	9bb0b89640b6d6738d86cdbb6d127153.exe	84
PID 2708 wrote to memory of 3916	2708	9bb0b89640b6d6738d86cdbb6d127153.exe	84
PID 2708 wrote to memory of 3916	2708	9bb0b89640b6d6738d86cdbb6d127153.exe	84
PID 2708 wrote to memory of 3916	2708	9bb0b89640b6d6738d86cdbb6d127153.exe	84
PID 2708 wrote to memory of 3916	2708	9bb0b89640b6d6738d86cdbb6d127153.exe	84
PID 2708 wrote to memory of 0	2708	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 2708 wrote to memory of 0	2708	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 2708 wrote to memory of 0	2708	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 2708 wrote to memory of 0	2708	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 2708 wrote to memory of 0	2708	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 2708 wrote to memory of 0	2708	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 2708 wrote to memory of 0	2708	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 2708 wrote to memory of 0	2708	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 2708 wrote to memory of 0	2708	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 2708 wrote to memory of 0	2708	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 2708 wrote to memory of 0	2708	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 2708 wrote to memory of 0	2708	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 2708 wrote to memory of 0	2708	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 2708 wrote to memory of 0	2708	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 2708 wrote to memory of 0	2708	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 2708 wrote to memory of 0	2708	9bb0b89640b6d6738d86cdbb6d127153.exe
PID 3916 wrote to memory of 3296	3916	9bb0b89640b6d6738d86cdbb6d127153.exe	78
PID 3916 wrote to memory of 3296	3916	9bb0b89640b6d6738d86cdbb6d127153.exe	78
PID 3916 wrote to memory of 3296	3916	9bb0b89640b6d6738d86cdbb6d127153.exe	78
PID 3916 wrote to memory of 3296	3916	9bb0b89640b6d6738d86cdbb6d127153.exe	78

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3296
- C:\Users\Admin\AppData\Local\Temp\9bb0b89640b6d6738d86cdbb6d127153.exe
  "C:\Users\Admin\AppData\Local\Temp\9bb0b89640b6d6738d86cdbb6d127153.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Users\Admin\AppData\Local\Temp\9bb0b89640b6d6738d86cdbb6d127153.exe
    "C:\Users\Admin\AppData\Local\Temp\9bb0b89640b6d6738d86cdbb6d127153.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3296-7-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3296-8-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/3916-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3916-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3916-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3916-6-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3916-13-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download