ee48174864ae0ef8c1e2da6b91b17c2f1df32195f69173adcc3013bf97c76ad5

Analysis

max time kernel
1560s
max time network
1562s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe
Size

180KB
MD5

fb30134f51e0558818038737ede9a1b0
SHA1

d364682050a1635182dc5abdfb1cc4174b8e333f
SHA256

e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc
SHA512

60db80ab100ed48f9764a560333bf19feb54232e4b4ebc2244f5eb32eb2092e97d61d912f7cc5b96c54ffbe40d1fd7b116b2724178f0f4e847ce2772e84e550f
SSDEEP

3072:qe3VbrfXktqKtl9CuglSCPTU15Y2Gh3hNyCd6U/5Nzc527JsM:qe3tGwuu6GVN/rQE7JsM

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe

description	pid	process	target process
PID 1652 set thread context of 2164	1652	e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe	e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe

pid	process
2164	e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe
2164	e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe

pid process

2164 e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe

pid process

2164 e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe

description	pid	process	target process
PID 1652 wrote to memory of 2164	1652	e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe	e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe
PID 1652 wrote to memory of 2164	1652	e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe	e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe
PID 1652 wrote to memory of 2164	1652	e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe	e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe
PID 1652 wrote to memory of 2164	1652	e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe	e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe
PID 1652 wrote to memory of 2164	1652	e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe	e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe
PID 1652 wrote to memory of 2164	1652	e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe	e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe
PID 1652 wrote to memory of 2164	1652	e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe	e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe
PID 1652 wrote to memory of 2164	1652	e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe	e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe
PID 1652 wrote to memory of 2164	1652	e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe	e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe
PID 1652 wrote to memory of 2164	1652	e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe	e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe
PID 1652 wrote to memory of 2164	1652	e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe	e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe

C:\Users\Admin\AppData\Local\Temp\e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe
"C:\Users\Admin\AppData\Local\Temp\e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1652

C:\Users\Admin\AppData\Local\Temp\e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe
"C:\Users\Admin\AppData\Local\Temp\e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2164-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2164-2-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2164-4-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2164-6-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2164-8-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2164-10-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2164-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2164-14-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2164-16-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2164-17-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download