98af4220d3b20bdeec6a30276b82f2b8bd7777021063815148b5e7ac7c37a449

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 21:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b9ad63d096ba634d7f35bf78b96b5143.exe
Size

284KB
MD5

b9ad63d096ba634d7f35bf78b96b5143
SHA1

2a94977aca5563f5080f5b0d6d110ebe0cfaf8d7
SHA256

98af4220d3b20bdeec6a30276b82f2b8bd7777021063815148b5e7ac7c37a449
SHA512

1f73bbaf7e114b47ef47adf459a0182b549ba3a6db75c9a893e0c95b75e13c953a3fee97911feeca2482e53dcfd6c783fff11a191edbb9dc93af715f8c4fc62a
SSDEEP

6144:5gb8KnHWWb2raBCDorAB1c29F2WG6Ncy2w3hro:5g3BCraBiDisHxro

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2908 set thread context of 2912	2908	b9ad63d096ba634d7f35bf78b96b5143.exe	28
PID 2912 set thread context of 2532	2912	b9ad63d096ba634d7f35bf78b96b5143.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2532	b9ad63d096ba634d7f35bf78b96b5143.exe
2532	b9ad63d096ba634d7f35bf78b96b5143.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2908	b9ad63d096ba634d7f35bf78b96b5143.exe
2912	b9ad63d096ba634d7f35bf78b96b5143.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2912	2908	b9ad63d096ba634d7f35bf78b96b5143.exe	28
PID 2908 wrote to memory of 2912	2908	b9ad63d096ba634d7f35bf78b96b5143.exe	28
PID 2908 wrote to memory of 2912	2908	b9ad63d096ba634d7f35bf78b96b5143.exe	28
PID 2908 wrote to memory of 2912	2908	b9ad63d096ba634d7f35bf78b96b5143.exe	28
PID 2908 wrote to memory of 2912	2908	b9ad63d096ba634d7f35bf78b96b5143.exe	28
PID 2908 wrote to memory of 2912	2908	b9ad63d096ba634d7f35bf78b96b5143.exe	28
PID 2908 wrote to memory of 2912	2908	b9ad63d096ba634d7f35bf78b96b5143.exe	28
PID 2908 wrote to memory of 2912	2908	b9ad63d096ba634d7f35bf78b96b5143.exe	28
PID 2908 wrote to memory of 2912	2908	b9ad63d096ba634d7f35bf78b96b5143.exe	28
PID 2908 wrote to memory of 2912	2908	b9ad63d096ba634d7f35bf78b96b5143.exe	28
PID 2912 wrote to memory of 2532	2912	b9ad63d096ba634d7f35bf78b96b5143.exe	29
PID 2912 wrote to memory of 2532	2912	b9ad63d096ba634d7f35bf78b96b5143.exe	29
PID 2912 wrote to memory of 2532	2912	b9ad63d096ba634d7f35bf78b96b5143.exe	29
PID 2912 wrote to memory of 2532	2912	b9ad63d096ba634d7f35bf78b96b5143.exe	29
PID 2912 wrote to memory of 2532	2912	b9ad63d096ba634d7f35bf78b96b5143.exe	29
PID 2912 wrote to memory of 2532	2912	b9ad63d096ba634d7f35bf78b96b5143.exe	29
PID 2912 wrote to memory of 2532	2912	b9ad63d096ba634d7f35bf78b96b5143.exe	29
PID 2912 wrote to memory of 2532	2912	b9ad63d096ba634d7f35bf78b96b5143.exe	29
PID 2532 wrote to memory of 1156	2532	b9ad63d096ba634d7f35bf78b96b5143.exe	20
PID 2532 wrote to memory of 1156	2532	b9ad63d096ba634d7f35bf78b96b5143.exe	20
PID 2532 wrote to memory of 1156	2532	b9ad63d096ba634d7f35bf78b96b5143.exe	20
PID 2532 wrote to memory of 1156	2532	b9ad63d096ba634d7f35bf78b96b5143.exe	20

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1156
- C:\Users\Admin\AppData\Local\Temp\b9ad63d096ba634d7f35bf78b96b5143.exe
  "C:\Users\Admin\AppData\Local\Temp\b9ad63d096ba634d7f35bf78b96b5143.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Users\Admin\AppData\Local\Temp\b9ad63d096ba634d7f35bf78b96b5143.exe
    C:\Users\Admin\AppData\Local\Temp\b9ad63d096ba634d7f35bf78b96b5143.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\b9ad63d096ba634d7f35bf78b96b5143.exe
      "C:\Users\Admin\AppData\Local\Temp\b9ad63d096ba634d7f35bf78b96b5143.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1156-19-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1156-23-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2532-18-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2532-16-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2532-33-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2532-21-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2532-15-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2532-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2908-0-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2908-5-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2908-2-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2912-11-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2912-17-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2912-14-0x0000000000410000-0x00000000004EF000-memory.dmp

Filesize
892KB

Download
memory/2912-4-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2912-8-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2912-7-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download