Analysis

  • max time kernel
    48s
  • max time network
    157s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    12-10-2022 15:53

General

  • Target

    b61bdc295133a491314f706c513aec2f2a88a0235c3483e2137903fb4ab9fc6f.exe

  • Size

    5.3MB

  • MD5

    e3b0df2abc353670ccd5b2c53d8b8ebe

  • SHA1

    bf47983fa8022a5e4a44e0b300660fab01ce6e29

  • SHA256

    b61bdc295133a491314f706c513aec2f2a88a0235c3483e2137903fb4ab9fc6f

  • SHA512

    1c82e23a59fb8b3e920f10b701cabb01ba95ae9ab7aafd86830ae482ef259d216af3d518f65d11ff4f950082edc07c79407e34fc7cd2f25643afa1fbc4cc48a1

  • SSDEEP

    49152:IIdualPUxZwxV/7GHt2He74cdP2llZw77LQ0soNF2He74cdr27lZw77LQ0soNcIi:RblPUmHzc4wWHzcAwHblPU

Malware Config

Signatures

  • joker

    Joker is an Android malware that targets billing and SMS fraud.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b61bdc295133a491314f706c513aec2f2a88a0235c3483e2137903fb4ab9fc6f.exe
    "C:\Users\Admin\AppData\Local\Temp\b61bdc295133a491314f706c513aec2f2a88a0235c3483e2137903fb4ab9fc6f.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1088-54-0x0000000000A90000-0x0000000000FE6000-memory.dmp

    Filesize

    5.3MB

  • memory/1088-55-0x00000000001E0000-0x00000000001E8000-memory.dmp

    Filesize

    32KB

  • memory/1088-56-0x000000001B600000-0x000000001B750000-memory.dmp

    Filesize

    1.3MB

  • memory/1088-57-0x00000000007A0000-0x00000000007D2000-memory.dmp

    Filesize

    200KB

  • memory/1088-58-0x000000001B1E0000-0x000000001B256000-memory.dmp

    Filesize

    472KB

  • memory/1088-59-0x00000000001F0000-0x00000000001FE000-memory.dmp

    Filesize

    56KB

  • memory/1088-60-0x0000000000200000-0x000000000020C000-memory.dmp

    Filesize

    48KB

  • memory/1088-61-0x0000000000580000-0x000000000058A000-memory.dmp

    Filesize

    40KB

  • memory/1088-62-0x0000000000970000-0x0000000000980000-memory.dmp

    Filesize

    64KB

  • memory/1088-63-0x000000001B750000-0x000000001B7D2000-memory.dmp

    Filesize

    520KB

  • memory/1088-64-0x0000000000980000-0x0000000000990000-memory.dmp

    Filesize

    64KB

  • memory/1088-65-0x0000000000990000-0x000000000099A000-memory.dmp

    Filesize

    40KB

  • memory/1088-66-0x00000000009A0000-0x00000000009AA000-memory.dmp

    Filesize

    40KB

  • memory/1088-67-0x0000000000A30000-0x0000000000A38000-memory.dmp

    Filesize

    32KB

  • memory/1088-68-0x000000001AC96000-0x000000001ACB5000-memory.dmp

    Filesize

    124KB

  • memory/1088-69-0x0000000000A40000-0x0000000000A48000-memory.dmp

    Filesize

    32KB

  • memory/1088-70-0x0000000000A50000-0x0000000000A58000-memory.dmp

    Filesize

    32KB

  • memory/1088-71-0x0000000000A60000-0x0000000000A68000-memory.dmp

    Filesize

    32KB

  • memory/1088-72-0x0000000000A70000-0x0000000000A78000-memory.dmp

    Filesize

    32KB

  • memory/1088-73-0x0000000000A80000-0x0000000000A88000-memory.dmp

    Filesize

    32KB

  • memory/1088-74-0x00000000023F0000-0x00000000023F8000-memory.dmp

    Filesize

    32KB

  • memory/1088-75-0x0000000002500000-0x0000000002508000-memory.dmp

    Filesize

    32KB

  • memory/1088-76-0x0000000002510000-0x000000000251A000-memory.dmp

    Filesize

    40KB

  • memory/1088-77-0x0000000002510000-0x000000000251A000-memory.dmp

    Filesize

    40KB

  • memory/1088-78-0x000000001AC96000-0x000000001ACB5000-memory.dmp

    Filesize

    124KB

  • memory/1088-79-0x0000000002510000-0x000000000251A000-memory.dmp

    Filesize

    40KB