Analysis
- max time kernel
148s - max time network
118s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
08/05/2024, 15:25
General
- Target p29D3FgSJF3zkbt.exe
- Size 951KB
- Sample240508-stlrjadc93
- SHA256 403fb4a908a97f67ebabaa9d60f9fc520d3f3f44a892c8f3b9b9fe44edf59df2
Malware Config
Signatures
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 27 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\p29D3FgSJF3zkbt.exe"C:\Users\Admin\AppData\Local\Temp\p29D3FgSJF3zkbt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\p29D3FgSJF3zkbt.exe"C:\Users\Admin\AppData\Local\Temp\p29D3FgSJF3zkbt.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Windows\SysWOW64\unlodctr.exe"C:\Windows\SysWOW64\unlodctr.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1208-22-0x0000000003D90000-0x0000000003E90000-memory.dmp
memory/1656-31-0x00000000023B0000-0x0000000002452000-memory.dmp
memory/1656-30-0x00000000000C0000-0x00000000000FF000-memory.dmp
memory/1656-29-0x00000000023B0000-0x0000000002452000-memory.dmp
memory/1656-28-0x00000000000C0000-0x00000000000FF000-memory.dmp
memory/1656-27-0x00000000020A0000-0x00000000023A3000-memory.dmp
memory/1656-24-0x00000000000C0000-0x00000000000FF000-memory.dmp
memory/1656-23-0x00000000000C0000-0x00000000000FF000-memory.dmp
memory/2004-7-0x00000000745A0000-0x0000000074C8E000-memory.dmp
memory/2004-5-0x0000000000850000-0x000000000085E000-memory.dmp
memory/2004-1-0x0000000000860000-0x0000000000950000-memory.dmp
memory/2004-2-0x00000000745A0000-0x0000000074C8E000-memory.dmp
memory/2004-3-0x0000000006E40000-0x0000000006EF4000-memory.dmp
memory/2004-16-0x00000000745A0000-0x0000000074C8E000-memory.dmp
memory/2004-4-0x0000000000570000-0x000000000058C000-memory.dmp
memory/2004-6-0x0000000001EE0000-0x0000000001EF6000-memory.dmp
memory/2004-0-0x00000000745AE000-0x00000000745AF000-memory.dmp
memory/2004-8-0x0000000007E80000-0x0000000007F0A000-memory.dmp
memory/2720-21-0x00000000002C0000-0x00000000002E3000-memory.dmp
memory/2720-20-0x0000000000400000-0x0000000000442000-memory.dmp
memory/2720-19-0x0000000000400000-0x0000000000442000-memory.dmp
memory/2720-18-0x0000000000400000-0x0000000000442000-memory.dmp
memory/2720-25-0x0000000000400000-0x0000000000442000-memory.dmp
memory/2720-26-0x00000000002C0000-0x00000000002E3000-memory.dmp
memory/2720-9-0x0000000000400000-0x0000000000442000-memory.dmp
memory/2720-17-0x0000000000AE0000-0x0000000000DE3000-memory.dmp
memory/2720-11-0x0000000000400000-0x0000000000442000-memory.dmp
memory/2720-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2720-15-0x0000000000400000-0x0000000000442000-memory.dmp