Analysis

  • max time kernel
    151s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220721-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-08-2022 11:35

General

  • Target

    a80af12cf15f3988662fedb9391f4c44848b4f288cf9921a5c78376d5df8891a.exe

  • Size

    5.3MB

  • MD5

    0d8165ac3e0360edb6e9236da2a9f36e

  • SHA1

    654bcab11060e8b2e81bde2a79e69cf8fcee6330

  • SHA256

    a80af12cf15f3988662fedb9391f4c44848b4f288cf9921a5c78376d5df8891a

  • SHA512

    cdab30915f6674c064c4de178f21dc203c44b3847f1386f7968aa5fc049261550c4c41589f6e4c711c5d8f49c2746093bb307e0ae0261a7fcf81b8d1167d4397

Malware Config

Signatures

  • joker

    Joker is an Android malware that targets billing and SMS fraud.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a80af12cf15f3988662fedb9391f4c44848b4f288cf9921a5c78376d5df8891a.exe
    "C:\Users\Admin\AppData\Local\Temp\a80af12cf15f3988662fedb9391f4c44848b4f288cf9921a5c78376d5df8891a.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/548-130-0x0000011762360000-0x00000117628B6000-memory.dmp

    Filesize

    5.3MB

  • memory/548-131-0x00007FFA85630000-0x00007FFA860F1000-memory.dmp

    Filesize

    10.8MB

  • memory/548-132-0x000001177EA00000-0x000001177EA0A000-memory.dmp

    Filesize

    40KB

  • memory/548-133-0x000001177EA10000-0x000001177EA18000-memory.dmp

    Filesize

    32KB

  • memory/548-134-0x000001177EA30000-0x000001177EA38000-memory.dmp

    Filesize

    32KB

  • memory/548-135-0x000001177EA40000-0x000001177EA48000-memory.dmp

    Filesize

    32KB

  • memory/548-136-0x000001177EA50000-0x000001177EA58000-memory.dmp

    Filesize

    32KB

  • memory/548-137-0x000001177EA60000-0x000001177EA68000-memory.dmp

    Filesize

    32KB

  • memory/548-138-0x000001177EA70000-0x000001177EA78000-memory.dmp

    Filesize

    32KB

  • memory/548-139-0x000001177EA80000-0x000001177EA88000-memory.dmp

    Filesize

    32KB

  • memory/548-140-0x000001177EA90000-0x000001177EA98000-memory.dmp

    Filesize

    32KB

  • memory/548-141-0x000001177FCF0000-0x000001177FCF8000-memory.dmp

    Filesize

    32KB

  • memory/548-142-0x000001177FC30000-0x000001177FC68000-memory.dmp

    Filesize

    224KB

  • memory/548-143-0x000001177FC00000-0x000001177FC0E000-memory.dmp

    Filesize

    56KB

  • memory/548-144-0x00007FFA85630000-0x00007FFA860F1000-memory.dmp

    Filesize

    10.8MB