84c1989b44d3b011679bbedcfb7f9f772a6ca27f8cfdaeb147033bdef9d8ccd9

General

Target

8fd32227ca310727137c28a5945497447ab479bd074d064ee11a6545d5eef5d6.exe
Size

1.2MB
MD5

2b5917ada9ef1cef3713977421874f68
SHA1

fb74e9a12166950199edc891c59bea4069edcd1c
SHA256

8fd32227ca310727137c28a5945497447ab479bd074d064ee11a6545d5eef5d6
SHA512

1e2c1cab61d86da2d4354a771a4eebb5221c47c09581e499d1e20211ca2e63a900992d829161b77d3231b7e09122411dfa195bf35cf82cf68d94490c9cab6008
SSDEEP

24576:jqDEvCTbMWu7rQYlBQcBiT6rprG8a/J0EhYslvrhI6cI:jTvC/MTQYxsWR7a/J0Eas9Iz

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1776 set thread context of 3040	1776	8fd32227ca310727137c28a5945497447ab479bd074d064ee11a6545d5eef5d6.exe	28
PID 3040 set thread context of 1184	3040	svchost.exe	21
PID 3040 set thread context of 2404	3040	svchost.exe	29
PID 2404 set thread context of 1184	2404	finger.exe	21

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
3040	svchost.exe
3040	svchost.exe
3040	svchost.exe
3040	svchost.exe
3040	svchost.exe
3040	svchost.exe
3040	svchost.exe
3040	svchost.exe
2404	finger.exe
2404	finger.exe
2404	finger.exe
2404	finger.exe
2404	finger.exe
2404	finger.exe
2404	finger.exe
2404	finger.exe
2404	finger.exe
2404	finger.exe
2404	finger.exe
2404	finger.exe
2404	finger.exe
2404	finger.exe
2404	finger.exe
2404	finger.exe
2404	finger.exe
2404	finger.exe
2404	finger.exe
2404	finger.exe
2404	finger.exe
2404	finger.exe
2404	finger.exe
2404	finger.exe
2404	finger.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
1776	8fd32227ca310727137c28a5945497447ab479bd074d064ee11a6545d5eef5d6.exe
3040	svchost.exe
1184	Explorer.EXE
1184	Explorer.EXE
2404	finger.exe
2404	finger.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 3040	1776	8fd32227ca310727137c28a5945497447ab479bd074d064ee11a6545d5eef5d6.exe	28
PID 1776 wrote to memory of 3040	1776	8fd32227ca310727137c28a5945497447ab479bd074d064ee11a6545d5eef5d6.exe	28
PID 1776 wrote to memory of 3040	1776	8fd32227ca310727137c28a5945497447ab479bd074d064ee11a6545d5eef5d6.exe	28
PID 1776 wrote to memory of 3040	1776	8fd32227ca310727137c28a5945497447ab479bd074d064ee11a6545d5eef5d6.exe	28
PID 1776 wrote to memory of 3040	1776	8fd32227ca310727137c28a5945497447ab479bd074d064ee11a6545d5eef5d6.exe	28
PID 1184 wrote to memory of 2404	1184	Explorer.EXE	29
PID 1184 wrote to memory of 2404	1184	Explorer.EXE	29
PID 1184 wrote to memory of 2404	1184	Explorer.EXE	29
PID 1184 wrote to memory of 2404	1184	Explorer.EXE	29

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Users\Admin\AppData\Local\Temp\8fd32227ca310727137c28a5945497447ab479bd074d064ee11a6545d5eef5d6.exe
  "C:\Users\Admin\AppData\Local\Temp\8fd32227ca310727137c28a5945497447ab479bd074d064ee11a6545d5eef5d6.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\8fd32227ca310727137c28a5945497447ab479bd074d064ee11a6545d5eef5d6.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:3040
- C:\Windows\SysWOW64\finger.exe
  "C:\Windows\SysWOW64\finger.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\vaccinators

Filesize
268KB

MD5
01cbc578c30426a9213885b2c7976328

SHA1
6cf0e0935f3464b676b308a0c4bbeb06d8eb2f4c

SHA256
8d208a375a96923985a66f18d0a6d646064851528b707f75e38128c1b66e6e46

SHA512
0cebf7f1d711a0b766cff83995ededde42bc2b8d4543ba890f603c01ca962a61d538b2f28bdaa85c032780ed875deee85ccd39870cc17e72a5199b273f98b573

Download Submit
memory/1184-28-0x0000000008CA0000-0x000000000BB38000-memory.dmp

Filesize
46.6MB

Download
memory/1184-16-0x0000000003C20000-0x0000000003D20000-memory.dmp

Filesize
1024KB

Download
memory/1184-19-0x0000000008CA0000-0x000000000BB38000-memory.dmp

Filesize
46.6MB

Download
memory/1776-11-0x0000000000150000-0x0000000000154000-memory.dmp

Filesize
16KB

Download
memory/2404-21-0x0000000000100000-0x0000000000140000-memory.dmp

Filesize
256KB

Download
memory/2404-29-0x0000000000100000-0x0000000000140000-memory.dmp

Filesize
256KB

Download
memory/2404-27-0x0000000002330000-0x00000000023D2000-memory.dmp

Filesize
648KB

Download
memory/2404-25-0x0000000000100000-0x0000000000140000-memory.dmp

Filesize
256KB

Download
memory/2404-24-0x0000000002020000-0x0000000002323000-memory.dmp

Filesize
3.0MB

Download
memory/2404-20-0x0000000000100000-0x0000000000140000-memory.dmp

Filesize
256KB

Download
memory/3040-17-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3040-23-0x0000000000200000-0x0000000000223000-memory.dmp

Filesize
140KB

Download
memory/3040-22-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3040-18-0x0000000000200000-0x0000000000223000-memory.dmp

Filesize
140KB

Download
memory/3040-15-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3040-14-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3040-13-0x0000000000B10000-0x0000000000E13000-memory.dmp

Filesize
3.0MB

Download
memory/3040-12-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing