9ad9044ccdce7cc6c110fd6f5fab5204c76f38a2e6107627a0b1478d004a7e5c

General

Target

E-2023-06-41-041-00843.scr.exe
Size

796KB
MD5

92ec67b7638c45ee9d630f040afa1a05
SHA1

71ba6474dfc1076790acac25273a27ec2b40855c
SHA256

9ad9044ccdce7cc6c110fd6f5fab5204c76f38a2e6107627a0b1478d004a7e5c
SHA512

f0dd2ccc5379bced925557830d95f1988ad5c397889aae3ca8a0dcfad655fd2579f0459b780c0044d3ebc98f65d8967b5768b312d21c31d402ed398d7f5e52f5
SSDEEP

12288:KP1U4Alx9gU2nghU/2Az/VOOxb4PpGzmSg83XlwEqBACR5leZlNGEwkR:KPVfNFTVdxb4PpGySgG1VsA+ersE3

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2312 set thread context of 1132	2312	E-2023-06-41-041-00843.scr.exe	28
PID 1132 set thread context of 1412	1132	E-2023-06-41-041-00843.scr.exe	21
PID 1132 set thread context of 768	1132	E-2023-06-41-041-00843.scr.exe	31
PID 768 set thread context of 1412	768	w32tm.exe	21

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
1132	E-2023-06-41-041-00843.scr.exe
1132	E-2023-06-41-041-00843.scr.exe
1132	E-2023-06-41-041-00843.scr.exe
1132	E-2023-06-41-041-00843.scr.exe
1132	E-2023-06-41-041-00843.scr.exe
1132	E-2023-06-41-041-00843.scr.exe
1132	E-2023-06-41-041-00843.scr.exe
1132	E-2023-06-41-041-00843.scr.exe
768	w32tm.exe
768	w32tm.exe
768	w32tm.exe
768	w32tm.exe
768	w32tm.exe
768	w32tm.exe
768	w32tm.exe
768	w32tm.exe
768	w32tm.exe
768	w32tm.exe
768	w32tm.exe
768	w32tm.exe
768	w32tm.exe
768	w32tm.exe
768	w32tm.exe
768	w32tm.exe
768	w32tm.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1132	E-2023-06-41-041-00843.scr.exe
1412	Explorer.EXE
1412	Explorer.EXE
768	w32tm.exe
768	w32tm.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 1132	2312	E-2023-06-41-041-00843.scr.exe	28
PID 2312 wrote to memory of 1132	2312	E-2023-06-41-041-00843.scr.exe	28
PID 2312 wrote to memory of 1132	2312	E-2023-06-41-041-00843.scr.exe	28
PID 2312 wrote to memory of 1132	2312	E-2023-06-41-041-00843.scr.exe	28
PID 2312 wrote to memory of 1132	2312	E-2023-06-41-041-00843.scr.exe	28
PID 2312 wrote to memory of 1132	2312	E-2023-06-41-041-00843.scr.exe	28
PID 2312 wrote to memory of 1132	2312	E-2023-06-41-041-00843.scr.exe	28
PID 1412 wrote to memory of 768	1412	Explorer.EXE	31
PID 1412 wrote to memory of 768	1412	Explorer.EXE	31
PID 1412 wrote to memory of 768	1412	Explorer.EXE	31
PID 1412 wrote to memory of 768	1412	Explorer.EXE	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Users\Admin\AppData\Local\Temp\E-2023-06-41-041-00843.scr.exe
  "C:\Users\Admin\AppData\Local\Temp\E-2023-06-41-041-00843.scr.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Users\Admin\AppData\Local\Temp\E-2023-06-41-041-00843.scr.exe
    "C:\Users\Admin\AppData\Local\Temp\E-2023-06-41-041-00843.scr.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:1132
- C:\Windows\SysWOW64\w32tm.exe
  "C:\Windows\SysWOW64\w32tm.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/768-19-0x0000000000130000-0x000000000016F000-memory.dmp

Filesize
252KB

Download
memory/768-28-0x0000000000CB0000-0x0000000000D50000-memory.dmp

Filesize
640KB

Download
memory/768-27-0x0000000000130000-0x000000000016F000-memory.dmp

Filesize
252KB

Download
memory/768-25-0x0000000000CB0000-0x0000000000D50000-memory.dmp

Filesize
640KB

Download
memory/768-24-0x0000000000130000-0x000000000016F000-memory.dmp

Filesize
252KB

Download
memory/768-23-0x0000000002240000-0x0000000002543000-memory.dmp

Filesize
3.0MB

Download
memory/768-20-0x0000000000130000-0x000000000016F000-memory.dmp

Filesize
252KB

Download
memory/1132-16-0x0000000000160000-0x0000000000181000-memory.dmp

Filesize
132KB

Download
memory/1132-10-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1132-7-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1132-22-0x0000000000160000-0x0000000000181000-memory.dmp

Filesize
132KB

Download
memory/1132-12-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1132-13-0x0000000000AE0000-0x0000000000DE3000-memory.dmp

Filesize
3.0MB

Download
memory/1132-14-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1132-21-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1132-15-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1132-6-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1132-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1412-18-0x0000000008700000-0x000000000A5C6000-memory.dmp

Filesize
30.8MB

Download
memory/1412-17-0x0000000000370000-0x0000000000470000-memory.dmp

Filesize
1024KB

Download
memory/1412-26-0x0000000008700000-0x000000000A5C6000-memory.dmp

Filesize
30.8MB

Download
memory/2312-0-0x0000000074B2E000-0x0000000074B2F000-memory.dmp

Filesize
4KB

Download
memory/2312-11-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2312-5-0x00000000004E0000-0x000000000056A000-memory.dmp

Filesize
552KB

Download
memory/2312-4-0x0000000000580000-0x0000000000590000-memory.dmp

Filesize
64KB

Download
memory/2312-3-0x00000000004B0000-0x00000000004D2000-memory.dmp

Filesize
136KB

Download
memory/2312-2-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2312-1-0x0000000000260000-0x000000000032A000-memory.dmp

Filesize
808KB

Download

Analysis

Sharing