f49bdf7228246b878930f80f090a7fde957d66ef5c2a7057366bf4c9af2151f0

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/03/2024, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b2a1abdf5a134f47e45ff0d65f45972f.exe
Size 138KB
Sample240304-vcd2gagc28
SHA256 f49bdf7228246b878930f80f090a7fde957d66ef5c2a7057366bf4c9af2151f0
MD5 b2a1abdf5a134f47e45ff0d65f45972f
SHA1 00f737d97ce5fcf2c1d056bd345cebd79fcd8c00
SHA512 42547fbfabbc6a98a68cd9bb16f82de3fe1fe0c00d09757ac7b6b4bbcba0e3e20f50da3615553ef8d1e36980d7b2beee35e96ff6d219f430553c9df01c601cbc
SSDEEP 3072:3uTb7gk1bFhTrpQ7T/ArGqcsQdiSB+e9OJ1:+LH1bFhT+nuQdiJeUH
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 856 set thread context of 2644	856	b2a1abdf5a134f47e45ff0d65f45972f.exe	89

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2644	b2a1abdf5a134f47e45ff0d65f45972f.exe
2644	b2a1abdf5a134f47e45ff0d65f45972f.exe
2644	b2a1abdf5a134f47e45ff0d65f45972f.exe
2644	b2a1abdf5a134f47e45ff0d65f45972f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
856	b2a1abdf5a134f47e45ff0d65f45972f.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 2644	856	b2a1abdf5a134f47e45ff0d65f45972f.exe	89
PID 856 wrote to memory of 2644	856	b2a1abdf5a134f47e45ff0d65f45972f.exe	89
PID 856 wrote to memory of 2644	856	b2a1abdf5a134f47e45ff0d65f45972f.exe	89
PID 856 wrote to memory of 2644	856	b2a1abdf5a134f47e45ff0d65f45972f.exe	89
PID 856 wrote to memory of 2644	856	b2a1abdf5a134f47e45ff0d65f45972f.exe	89
PID 856 wrote to memory of 2644	856	b2a1abdf5a134f47e45ff0d65f45972f.exe	89
PID 856 wrote to memory of 2644	856	b2a1abdf5a134f47e45ff0d65f45972f.exe	89
PID 2644 wrote to memory of 3388	2644	b2a1abdf5a134f47e45ff0d65f45972f.exe	57
PID 2644 wrote to memory of 3388	2644	b2a1abdf5a134f47e45ff0d65f45972f.exe	57
PID 2644 wrote to memory of 3388	2644	b2a1abdf5a134f47e45ff0d65f45972f.exe	57
PID 2644 wrote to memory of 3388	2644	b2a1abdf5a134f47e45ff0d65f45972f.exe	57

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3388
- C:\Users\Admin\AppData\Local\Temp\b2a1abdf5a134f47e45ff0d65f45972f.exe
  "C:\Users\Admin\AppData\Local\Temp\b2a1abdf5a134f47e45ff0d65f45972f.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:856
- - C:\Users\Admin\AppData\Local\Temp\b2a1abdf5a134f47e45ff0d65f45972f.exe
    C:\Users\Admin\AppData\Local\Temp\b2a1abdf5a134f47e45ff0d65f45972f.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/856-0-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/856-1-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/856-2-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/856-9-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/2644-10-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/2644-8-0x0000000000400000-0x00000000004083A0-memory.dmp

Download

memory/2644-7-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/2644-5-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/2644-11-0x0000000010000000-0x0000000010012000-memory.dmp

Download

memory/2644-18-0x0000000000400000-0x00000000004083A0-memory.dmp

Download

memory/2644-19-0x0000000010000000-0x0000000010012000-memory.dmp

Download

memory/3388-13-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Download

memory/3388-14-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Download