Analysis
- max time kernel
147s - max time network
125s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
11/06/2024, 19:19
General
- Target W5TnMyRi78vdxpf.exe
- Size 744KB
- Sample240611-x1hexayane
- SHA256 653f0905ba65d6e908d3467e8e60ee65689ef99e0dd471237e222f9b20278e5e
Malware Config
Signatures
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 27 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\W5TnMyRi78vdxpf.exe"C:\Users\Admin\AppData\Local\Temp\W5TnMyRi78vdxpf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\W5TnMyRi78vdxpf.exe"C:\Users\Admin\AppData\Local\Temp\W5TnMyRi78vdxpf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Windows\SysWOW64\sdchange.exe"C:\Windows\SysWOW64\sdchange.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1216-20-0x0000000009040000-0x000000000BC41000-memory.dmp
memory/1216-28-0x0000000009040000-0x000000000BC41000-memory.dmp
memory/2520-15-0x0000000000980000-0x0000000000C83000-memory.dmp
memory/2520-23-0x0000000000400000-0x0000000000443000-memory.dmp
memory/2520-19-0x00000000001A0000-0x00000000001C4000-memory.dmp
memory/2520-18-0x0000000000400000-0x0000000000443000-memory.dmp
memory/2520-6-0x0000000000400000-0x0000000000443000-memory.dmp
memory/2520-12-0x0000000000400000-0x0000000000443000-memory.dmp
memory/2520-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2520-8-0x0000000000400000-0x0000000000443000-memory.dmp
memory/2520-24-0x00000000001A0000-0x00000000001C4000-memory.dmp
memory/2520-17-0x0000000000400000-0x0000000000443000-memory.dmp
memory/2520-16-0x0000000000400000-0x0000000000443000-memory.dmp
memory/2696-5-0x0000000005A60000-0x0000000005AEA000-memory.dmp
memory/2696-3-0x0000000000510000-0x0000000000532000-memory.dmp
memory/2696-1-0x0000000000FC0000-0x000000000107E000-memory.dmp
memory/2696-14-0x00000000745F0000-0x0000000074CDE000-memory.dmp
memory/2696-2-0x00000000745F0000-0x0000000074CDE000-memory.dmp
memory/2696-0-0x00000000745FE000-0x00000000745FF000-memory.dmp
memory/2696-13-0x00000000745FE000-0x00000000745FF000-memory.dmp
memory/2696-4-0x00000000004D0000-0x00000000004E0000-memory.dmp
memory/2812-25-0x00000000020C0000-0x00000000023C3000-memory.dmp
memory/2812-22-0x0000000000080000-0x00000000000BF000-memory.dmp
memory/2812-21-0x0000000000080000-0x00000000000BF000-memory.dmp
memory/2812-27-0x0000000000C00000-0x0000000000CA3000-memory.dmp
memory/2812-26-0x0000000000080000-0x00000000000BF000-memory.dmp
memory/2812-29-0x0000000000080000-0x00000000000BF000-memory.dmp