211aa8f15a37e6d2244b4a9b2d1c5494b9826f0cc469372873659485ec1087a5 | Triage

Analysis

max time kernel
156s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14-03-2024 13:42

Sharing

Report Analysis Logs

General

Target

ProcessStealth.exe
Size

60KB
MD5

8dd3f6b32f9f7cd335c90439ba34ea2e
SHA1

f0567a5331efd8ba685bfd1a56f56868198382ca
SHA256

211aa8f15a37e6d2244b4a9b2d1c5494b9826f0cc469372873659485ec1087a5
SHA512

c8416415552cc7d89b770a1305d56289ef1f1b1c7f4852ea7d1dd81697fc681f8b175cfe915804b0ad2faeb30195b0cae2cb3dcbdc5e413faae7e12e97e9f33f
SSDEEP

768:n4NdQTHZPkKaYOlkfEqTIYv4gKNwFPFceMpaSIhkqe7+JD:nodiTEqTIm4gKN2PFNYaBEED

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2956	ProcessStealth.exe
2956	ProcessStealth.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 4500	2956	ProcessStealth.exe	95
PID 2956 wrote to memory of 4500	2956	ProcessStealth.exe	95

C:\Users\Admin\AppData\Local\Temp\ProcessStealth.exe
"C:\Users\Admin\AppData\Local\Temp\ProcessStealth.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:4500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2260,i,3303482231723870786,2954015409682154873,262144 --variations-seed-version /prefetch:8
1⤵
PID:3936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2956-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download