Analysis
- max time kernel
22s - max time network
122s - platform
windows10_x64 - resource
win10v20210408 - submitted
08/09/2021, 22:20
General
- Target overd0se loader.exe
- Size 3.0MB
- Sample210908-18385afbe5
- SHA256 1e1910e710d721ff5b3eb050c47d963aac56df963ad2fbb5ff9decb47ce5e8b1
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\overd0se loader.exe"C:\Users\Admin\AppData\Local\Temp\overd0se loader.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 10762⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3728-114-0x00000000FEAA0000-0x00000000FEE71000-memory.dmp
memory/3728-115-0x0000000000250000-0x0000000000252000-memory.dmp
memory/3728-117-0x0000000006890000-0x0000000006891000-memory.dmp
memory/3728-118-0x0000000006DA0000-0x0000000006DA1000-memory.dmp
memory/3728-119-0x0000000006740000-0x0000000006741000-memory.dmp