84c514f841b26e888b56a0baa77c5ecd7e49ce270845ab35806016e468ff6d1b

General

Target

d2585129c23de9308dfdc114f4997f8ec6dafa1057669718e27f0467cf66ad2c.exe
Size

1.1MB
MD5

14e46bbab699b36b4dd13c1534c9d6cf
SHA1

aa8cb619778e5086de63ef93d3aea6f9863d4fb8
SHA256

d2585129c23de9308dfdc114f4997f8ec6dafa1057669718e27f0467cf66ad2c
SHA512

d6d14206a972ccee542acb66e9ccd12d256db1a325cdaefeffeac34fd38b68ddc3ec5a04587c55c2172edcb4779a064d83006858f99a31704e70e2a4b11d978c
SSDEEP

24576:JAHnh+eWsN3skA4RV1Hom2KXMmHar7kekao2D4TOGeAhsP5:Qh+ZkldoPK8YaPLDUDhA

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2784 set thread context of 2652	2784	d2585129c23de9308dfdc114f4997f8ec6dafa1057669718e27f0467cf66ad2c.exe	28
PID 2652 set thread context of 1216	2652	svchost.exe	21
PID 2652 set thread context of 1688	2652	svchost.exe	29
PID 1688 set thread context of 1216	1688	whoami.exe	21

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2652	svchost.exe
2652	svchost.exe
2652	svchost.exe
2652	svchost.exe
2652	svchost.exe
2652	svchost.exe
2652	svchost.exe
2652	svchost.exe
1688	whoami.exe
1688	whoami.exe
1688	whoami.exe
1688	whoami.exe
1688	whoami.exe
1688	whoami.exe
1688	whoami.exe
1688	whoami.exe
1688	whoami.exe
1688	whoami.exe
1688	whoami.exe
1688	whoami.exe
1688	whoami.exe
1688	whoami.exe
1688	whoami.exe
1688	whoami.exe
1688	whoami.exe
1688	whoami.exe
1688	whoami.exe
1688	whoami.exe
1688	whoami.exe
1688	whoami.exe
1688	whoami.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
2784	d2585129c23de9308dfdc114f4997f8ec6dafa1057669718e27f0467cf66ad2c.exe
2652	svchost.exe
1216	Explorer.EXE
1216	Explorer.EXE
1688	whoami.exe
1688	whoami.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2784	d2585129c23de9308dfdc114f4997f8ec6dafa1057669718e27f0467cf66ad2c.exe
2784	d2585129c23de9308dfdc114f4997f8ec6dafa1057669718e27f0467cf66ad2c.exe
1216	Explorer.EXE
1216	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2784	d2585129c23de9308dfdc114f4997f8ec6dafa1057669718e27f0467cf66ad2c.exe
2784	d2585129c23de9308dfdc114f4997f8ec6dafa1057669718e27f0467cf66ad2c.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2652	2784	d2585129c23de9308dfdc114f4997f8ec6dafa1057669718e27f0467cf66ad2c.exe	28
PID 2784 wrote to memory of 2652	2784	d2585129c23de9308dfdc114f4997f8ec6dafa1057669718e27f0467cf66ad2c.exe	28
PID 2784 wrote to memory of 2652	2784	d2585129c23de9308dfdc114f4997f8ec6dafa1057669718e27f0467cf66ad2c.exe	28
PID 2784 wrote to memory of 2652	2784	d2585129c23de9308dfdc114f4997f8ec6dafa1057669718e27f0467cf66ad2c.exe	28
PID 2784 wrote to memory of 2652	2784	d2585129c23de9308dfdc114f4997f8ec6dafa1057669718e27f0467cf66ad2c.exe	28
PID 1216 wrote to memory of 1688	1216	Explorer.EXE	29
PID 1216 wrote to memory of 1688	1216	Explorer.EXE	29
PID 1216 wrote to memory of 1688	1216	Explorer.EXE	29
PID 1216 wrote to memory of 1688	1216	Explorer.EXE	29

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Users\Admin\AppData\Local\Temp\d2585129c23de9308dfdc114f4997f8ec6dafa1057669718e27f0467cf66ad2c.exe
  "C:\Users\Admin\AppData\Local\Temp\d2585129c23de9308dfdc114f4997f8ec6dafa1057669718e27f0467cf66ad2c.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\d2585129c23de9308dfdc114f4997f8ec6dafa1057669718e27f0467cf66ad2c.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2652
- C:\Windows\SysWOW64\whoami.exe
  "C:\Windows\SysWOW64\whoami.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:1688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\done

Filesize
268KB

MD5
740d19aa118d963b587d80fe480f8844

SHA1
271d9eebf24bb1b8986871bedd19d87e8b1ab62f

SHA256
37162e911e48eeb3599f6411be0c988580e2fefb6465f520f0573ed4753d19c2

SHA512
b354cd62a5e48578501901dab7cc2fd5023cad4ac8fe5df3683fd6a3dc80b2810379acefb711971fca843e5b10c8fca77ac50bab9ae6ff3403cf45ef8716bb5d

Download Submit
memory/1216-19-0x0000000003D30000-0x0000000003E30000-memory.dmp

Filesize
1024KB

Download
memory/1216-28-0x0000000009110000-0x000000000A50C000-memory.dmp

Filesize
20.0MB

Download
memory/1216-20-0x0000000009110000-0x000000000A50C000-memory.dmp

Filesize
20.0MB

Download
memory/1688-25-0x0000000002000000-0x0000000002303000-memory.dmp

Filesize
3.0MB

Download
memory/1688-21-0x00000000000C0000-0x0000000000100000-memory.dmp

Filesize
256KB

Download
memory/1688-29-0x00000000000C0000-0x0000000000100000-memory.dmp

Filesize
256KB

Download
memory/1688-27-0x0000000000900000-0x00000000009A1000-memory.dmp

Filesize
644KB

Download
memory/1688-26-0x00000000000C0000-0x0000000000100000-memory.dmp

Filesize
256KB

Download
memory/1688-22-0x00000000000C0000-0x0000000000100000-memory.dmp

Filesize
256KB

Download
memory/2652-18-0x00000000001A0000-0x00000000001C2000-memory.dmp

Filesize
136KB

Download
memory/2652-13-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2652-14-0x00000000008A0000-0x0000000000BA3000-memory.dmp

Filesize
3.0MB

Download
memory/2652-24-0x00000000001A0000-0x00000000001C2000-memory.dmp

Filesize
136KB

Download
memory/2652-23-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2652-12-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2652-15-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2652-17-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2652-16-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2784-11-0x00000000002D0000-0x00000000002D4000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing