Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/06/2024, 01:14
Static task
static1
Behavioral task
behavioral1
Sample
445c00e14a4a3eaf7e11d2858d4c963d8ce5c31ccbdff0fb275436357d6ce5c0.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
445c00e14a4a3eaf7e11d2858d4c963d8ce5c31ccbdff0fb275436357d6ce5c0.exe
Resource
win10v2004-20240508-en
General
-
Target
445c00e14a4a3eaf7e11d2858d4c963d8ce5c31ccbdff0fb275436357d6ce5c0.exe
-
Size
1.2MB
-
MD5
1dc0ef58fcd118eda3e4e6db7f790655
-
SHA1
eeaf577a39f32004a26863b48a551e3150e1e9c6
-
SHA256
445c00e14a4a3eaf7e11d2858d4c963d8ce5c31ccbdff0fb275436357d6ce5c0
-
SHA512
847d484b47f9b6e603cded70bb2b921030aefb9c78673d9ef3f0106b7179cc4c468ba9cd2202f2985c8339168ea18e468ccac5c88d8f0e03cd765b850eb6576d
-
SSDEEP
24576:VqDEvCTbMWu7rQYlBQcBiT6rprG8a3CswWnPk71SNhDB/lJ6XRvfp:VTvC/MTQYxsWR7a3nwWn8BSjwf
Malware Config
Signatures
-
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 416 set thread context of 1924 416 445c00e14a4a3eaf7e11d2858d4c963d8ce5c31ccbdff0fb275436357d6ce5c0.exe 85 PID 1924 set thread context of 3400 1924 svchost.exe 56 PID 1924 set thread context of 3620 1924 svchost.exe 88 PID 3620 set thread context of 3400 3620 write.exe 56 -
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 1924 svchost.exe 1924 svchost.exe 1924 svchost.exe 1924 svchost.exe 1924 svchost.exe 1924 svchost.exe 1924 svchost.exe 1924 svchost.exe 1924 svchost.exe 1924 svchost.exe 1924 svchost.exe 1924 svchost.exe 1924 svchost.exe 1924 svchost.exe 1924 svchost.exe 1924 svchost.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe 3620 write.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 416 445c00e14a4a3eaf7e11d2858d4c963d8ce5c31ccbdff0fb275436357d6ce5c0.exe 1924 svchost.exe 3400 Explorer.EXE 3400 Explorer.EXE 3620 write.exe 3620 write.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3400 Explorer.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 416 wrote to memory of 1924 416 445c00e14a4a3eaf7e11d2858d4c963d8ce5c31ccbdff0fb275436357d6ce5c0.exe 85 PID 416 wrote to memory of 1924 416 445c00e14a4a3eaf7e11d2858d4c963d8ce5c31ccbdff0fb275436357d6ce5c0.exe 85 PID 416 wrote to memory of 1924 416 445c00e14a4a3eaf7e11d2858d4c963d8ce5c31ccbdff0fb275436357d6ce5c0.exe 85 PID 416 wrote to memory of 1924 416 445c00e14a4a3eaf7e11d2858d4c963d8ce5c31ccbdff0fb275436357d6ce5c0.exe 85 PID 3400 wrote to memory of 3620 3400 Explorer.EXE 88 PID 3400 wrote to memory of 3620 3400 Explorer.EXE 88 PID 3400 wrote to memory of 3620 3400 Explorer.EXE 88
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\445c00e14a4a3eaf7e11d2858d4c963d8ce5c31ccbdff0fb275436357d6ce5c0.exe"C:\Users\Admin\AppData\Local\Temp\445c00e14a4a3eaf7e11d2858d4c963d8ce5c31ccbdff0fb275436357d6ce5c0.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\445c00e14a4a3eaf7e11d2858d4c963d8ce5c31ccbdff0fb275436357d6ce5c0.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1924
-
-
-
C:\Windows\SysWOW64\write.exe"C:\Windows\SysWOW64\write.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3620
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5db6785e9322897354fe19bf85d0ac3d4
SHA140a149185c562422409a323009dde774174be772
SHA2564cd0ce24b2b2e0bca5066c5469ecba0a84dbebc4f49f27f15abba3e8e49d3cfb
SHA512e6e803398d25093b291f29908c6588a8f096a2e12645489ac52d2d1a52d56d482ef9d3952b80fe4b8d19472d774bc240b5e9a3c18b500ef8613a1b5d1e506077