a505c17117d77b38d502a1386392c94ed32d559819a5106de1bda80516d976ef

General

Target

Scan9430654.exe
Size

1.2MB
MD5

cb04e4165970dbd63faf5741f0029684
SHA1

078fd9a302c529336f8abea032eb3b5c4f911242
SHA256

a505c17117d77b38d502a1386392c94ed32d559819a5106de1bda80516d976ef
SHA512

65c0b0fdb31067cb1501f49f5da7d66a71bdbb0936c857347ab826e2692035435ccd2cac33998b18b5931e0dcd937e8c2a80bb61b24d816c39e75b2354f8c9bd
SSDEEP

24576:YAHnh+eWsN3skA4RV1Hom2KXMmHaQ7gmDCeBxWTdlRIz5:fh+ZkldoPK8YaIgmHLWTvK

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1176 set thread context of 2216	1176	Scan9430654.exe	28
PID 2216 set thread context of 1248	2216	svchost.exe	21
PID 2216 set thread context of 2552	2216	svchost.exe	29
PID 2552 set thread context of 1248	2552	whoami.exe	21

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2216	svchost.exe
2216	svchost.exe
2216	svchost.exe
2216	svchost.exe
2216	svchost.exe
2216	svchost.exe
2216	svchost.exe
2216	svchost.exe
2552	whoami.exe
2552	whoami.exe
2552	whoami.exe
2552	whoami.exe
2552	whoami.exe
2552	whoami.exe
2552	whoami.exe
2552	whoami.exe
2552	whoami.exe
2552	whoami.exe
2552	whoami.exe
2552	whoami.exe
2552	whoami.exe
2552	whoami.exe
2552	whoami.exe
2552	whoami.exe
2552	whoami.exe
2552	whoami.exe
2552	whoami.exe
2552	whoami.exe
2552	whoami.exe
2552	whoami.exe
2552	whoami.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
1176	Scan9430654.exe
2216	svchost.exe
1248	Explorer.EXE
1248	Explorer.EXE
2552	whoami.exe
2552	whoami.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1176	Scan9430654.exe
1176	Scan9430654.exe
1248	Explorer.EXE
1248	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1176	Scan9430654.exe
1176	Scan9430654.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 2216	1176	Scan9430654.exe	28
PID 1176 wrote to memory of 2216	1176	Scan9430654.exe	28
PID 1176 wrote to memory of 2216	1176	Scan9430654.exe	28
PID 1176 wrote to memory of 2216	1176	Scan9430654.exe	28
PID 1176 wrote to memory of 2216	1176	Scan9430654.exe	28
PID 1248 wrote to memory of 2552	1248	Explorer.EXE	29
PID 1248 wrote to memory of 2552	1248	Explorer.EXE	29
PID 1248 wrote to memory of 2552	1248	Explorer.EXE	29
PID 1248 wrote to memory of 2552	1248	Explorer.EXE	29

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Users\Admin\AppData\Local\Temp\Scan9430654.exe
  "C:\Users\Admin\AppData\Local\Temp\Scan9430654.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\Scan9430654.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2216
- C:\Windows\SysWOW64\whoami.exe
  "C:\Windows\SysWOW64\whoami.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\maneuverability

Filesize
268KB

MD5
b108d89a92c27349d5f10c5c85371940

SHA1
8ebdbe3f9b47aca1df1dac9b45038740bacdd4e8

SHA256
c155ed4f0f7ad8eb0ededb57b0c88113ba5bb11d22274d46d8cc16db136a6be0

SHA512
95b1164c67d38f7e645fd2e39fcf948967ee3d2f2a9f2fd384eb86a3079d05a079c001b44c6c8198217e780e67779e7d1314ac1ff07f910163ee993b1c750bb2

Download Submit
memory/1176-11-0x0000000000160000-0x0000000000164000-memory.dmp

Filesize
16KB

Download
memory/1248-28-0x0000000009060000-0x000000000AFDB000-memory.dmp

Filesize
31.5MB

Download
memory/1248-20-0x0000000009060000-0x000000000AFDB000-memory.dmp

Filesize
31.5MB

Download
memory/1248-19-0x0000000002FC0000-0x00000000030C0000-memory.dmp

Filesize
1024KB

Download
memory/2216-15-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2216-23-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2216-17-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2216-14-0x0000000000720000-0x0000000000A23000-memory.dmp

Filesize
3.0MB

Download
memory/2216-18-0x0000000000370000-0x0000000000392000-memory.dmp

Filesize
136KB

Download
memory/2216-13-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2216-12-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2216-16-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2216-24-0x0000000000370000-0x0000000000392000-memory.dmp

Filesize
136KB

Download
memory/2552-22-0x0000000000080000-0x00000000000C0000-memory.dmp

Filesize
256KB

Download
memory/2552-25-0x0000000001F00000-0x0000000002203000-memory.dmp

Filesize
3.0MB

Download
memory/2552-26-0x0000000000080000-0x00000000000C0000-memory.dmp

Filesize
256KB

Download
memory/2552-27-0x0000000001D70000-0x0000000001E11000-memory.dmp

Filesize
644KB

Download
memory/2552-21-0x0000000000080000-0x00000000000C0000-memory.dmp

Filesize
256KB

Download
memory/2552-29-0x0000000000080000-0x00000000000C0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing