4b0ee61b0c2873d1e86b99f48ddacae7ce51efc7272048827ae368b98cafe2be

Analysis

max time kernel
146s
max time network
122s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 07:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 909KB
Sample240416-jgdqqaed21
SHA256 4b0ee61b0c2873d1e86b99f48ddacae7ce51efc7272048827ae368b98cafe2be
MD5 8ad33ef9b2c5ace2b195d8213525809d
SHA1 4dda6258af72ad6e2d70c61238baeecb8cd05ed5
SHA512 97839e01a01c8846159cdd02936bbe9d617cc3b7984d7d679e5bd95914d0a4a940ee2add292a53543fe9d4df4904e7090aace0488a3de9fddd1bf427d84c5392
SSDEEP 24576:Y1oG8je76qs4LXS+1k1z/hOwmRRhljKQv:SoG8jqs6S+X5RRhlH
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2228 set thread context of 2548	2228	file.exe	29
PID 2548 set thread context of 1204	2548	file.exe	21
PID 2548 set thread context of 2688	2548	file.exe	32
PID 2688 set thread context of 1204	2688	unlodctr.exe	21

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
2228	file.exe
2228	file.exe
2228	file.exe
2548	file.exe
2548	file.exe
2548	file.exe
2548	file.exe
2548	file.exe
2548	file.exe
2548	file.exe
2548	file.exe
2688	unlodctr.exe
2688	unlodctr.exe
2688	unlodctr.exe
2688	unlodctr.exe
2688	unlodctr.exe
2688	unlodctr.exe
2688	unlodctr.exe
2688	unlodctr.exe
2688	unlodctr.exe
2688	unlodctr.exe
2688	unlodctr.exe
2688	unlodctr.exe
2688	unlodctr.exe
2688	unlodctr.exe
2688	unlodctr.exe
2688	unlodctr.exe
2688	unlodctr.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2548	file.exe
1204	Explorer.EXE
1204	Explorer.EXE
2688	unlodctr.exe
2688	unlodctr.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2228	file.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2544	2228	file.exe	28
PID 2228 wrote to memory of 2544	2228	file.exe	28
PID 2228 wrote to memory of 2544	2228	file.exe	28
PID 2228 wrote to memory of 2544	2228	file.exe	28
PID 2228 wrote to memory of 2548	2228	file.exe	29
PID 2228 wrote to memory of 2548	2228	file.exe	29
PID 2228 wrote to memory of 2548	2228	file.exe	29
PID 2228 wrote to memory of 2548	2228	file.exe	29
PID 2228 wrote to memory of 2548	2228	file.exe	29
PID 2228 wrote to memory of 2548	2228	file.exe	29
PID 2228 wrote to memory of 2548	2228	file.exe	29
PID 1204 wrote to memory of 2688	1204	Explorer.EXE	32
PID 1204 wrote to memory of 2688	1204	Explorer.EXE	32
PID 1204 wrote to memory of 2688	1204	Explorer.EXE	32
PID 1204 wrote to memory of 2688	1204	Explorer.EXE	32

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    3⤵
    PID:2544
- - C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2548
- C:\Windows\SysWOW64\unlodctr.exe
  "C:\Windows\SysWOW64\unlodctr.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1204-28-0x00000000094D0000-0x000000000B9A0000-memory.dmp

Download

memory/1204-21-0x00000000094D0000-0x000000000B9A0000-memory.dmp

Download

memory/2228-15-0x0000000074800000-0x0000000074EEE000-memory.dmp

Download

memory/2228-1-0x0000000074800000-0x0000000074EEE000-memory.dmp

Download

memory/2228-2-0x0000000000E40000-0x0000000000E80000-memory.dmp

Download

memory/2228-3-0x0000000007630000-0x00000000076D6000-memory.dmp

Download

memory/2228-4-0x0000000000480000-0x0000000000492000-memory.dmp

Download

memory/2228-5-0x00000000004B0000-0x00000000004B8000-memory.dmp

Download

memory/2228-6-0x00000000004D0000-0x00000000004DC000-memory.dmp

Download

memory/2228-7-0x0000000007980000-0x0000000007A0A000-memory.dmp

Download

memory/2228-0-0x0000000000FA0000-0x0000000001084000-memory.dmp

Download

memory/2548-17-0x00000000008B0000-0x0000000000BB3000-memory.dmp

Download

memory/2548-24-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2548-16-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2548-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2548-18-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2548-19-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2548-20-0x0000000000340000-0x0000000000363000-memory.dmp

Download

memory/2548-10-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2548-8-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2548-14-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2688-23-0x00000000000F0000-0x000000000012F000-memory.dmp

Download

memory/2688-25-0x0000000002160000-0x0000000002463000-memory.dmp

Download

memory/2688-26-0x00000000000F0000-0x000000000012F000-memory.dmp

Download

memory/2688-27-0x0000000000C20000-0x0000000000CC2000-memory.dmp

Download

memory/2688-22-0x00000000000F0000-0x000000000012F000-memory.dmp

Download

memory/2688-29-0x00000000000F0000-0x000000000012F000-memory.dmp

Download

memory/2688-30-0x0000000000C20000-0x0000000000CC2000-memory.dmp

Download