Analysis
-
max time kernel
47s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
20-02-2022 03:03
Static task
static1
Behavioral task
behavioral1
Sample
b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
Resource
win10v2004-en-20220113
0 signatures
0 seconds
General
-
Target
b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
-
Size
207KB
-
MD5
f2f7bef5ff555a8d94876c33903e3676
-
SHA1
d54850d80c6ada0c22881048640f911b79ea6d35
-
SHA256
b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a
-
SHA512
97d2eedba86483e60073a42fcefa1a6b06abf37a425dd4c2a03e3d11523e213340fbfb2bcc6cd9efd97c5d5cdcbc71b411aeb486df456433e2e5c0e5b1d2efed
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exepid process 360 b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe 360 b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe 360 b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe 360 b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exedescription pid process Token: SeDebugPrivilege 360 b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exedescription pid process target process PID 360 wrote to memory of 2320 360 b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe sihost.exe PID 360 wrote to memory of 2328 360 b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe svchost.exe PID 360 wrote to memory of 2444 360 b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe taskhostw.exe PID 360 wrote to memory of 8 360 b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe svchost.exe PID 360 wrote to memory of 3268 360 b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe DllHost.exe
Processes
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe"C:\Users\Admin\AppData\Local\Temp\b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory