Analysis
-
max time kernel
48s -
max time network
56s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/10/2022, 21:34
Behavioral task
behavioral1
Sample
d77346745325751a39d77202e83af104ed44a7b02ba1545b909bad4160425b2d.exe
Resource
win7-20220812-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
d77346745325751a39d77202e83af104ed44a7b02ba1545b909bad4160425b2d.exe
Resource
win10v2004-20220812-en
2 signatures
150 seconds
General
-
Target
d77346745325751a39d77202e83af104ed44a7b02ba1545b909bad4160425b2d.exe
-
Size
37KB
-
MD5
922268ef8785adb812525c3fd4372710
-
SHA1
1b440f720963596ba5fc4bdb3e5085528d1cb559
-
SHA256
d77346745325751a39d77202e83af104ed44a7b02ba1545b909bad4160425b2d
-
SHA512
dc144e667e18bbe0241651b3cc10159d2653499c22d406d35f7bbcdf6e1c838d4522d4818c6ced3b3e77638943a26846a1d3aaddea1490d3954524a70b0b1837
-
SSDEEP
768:mtcXQU7ao9ALzICT5PlopIh+u7lf7OwxgV0nbcuyD7U0rsSKBdo:mtNHLzICTzh+uJzNnouy804Bdo
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1364-55-0x0000000000400000-0x0000000000417000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1364 d77346745325751a39d77202e83af104ed44a7b02ba1545b909bad4160425b2d.exe 1364 d77346745325751a39d77202e83af104ed44a7b02ba1545b909bad4160425b2d.exe 1364 d77346745325751a39d77202e83af104ed44a7b02ba1545b909bad4160425b2d.exe 1364 d77346745325751a39d77202e83af104ed44a7b02ba1545b909bad4160425b2d.exe 1364 d77346745325751a39d77202e83af104ed44a7b02ba1545b909bad4160425b2d.exe 1364 d77346745325751a39d77202e83af104ed44a7b02ba1545b909bad4160425b2d.exe 1364 d77346745325751a39d77202e83af104ed44a7b02ba1545b909bad4160425b2d.exe 1364 d77346745325751a39d77202e83af104ed44a7b02ba1545b909bad4160425b2d.exe 1364 d77346745325751a39d77202e83af104ed44a7b02ba1545b909bad4160425b2d.exe 1364 d77346745325751a39d77202e83af104ed44a7b02ba1545b909bad4160425b2d.exe 1364 d77346745325751a39d77202e83af104ed44a7b02ba1545b909bad4160425b2d.exe 1364 d77346745325751a39d77202e83af104ed44a7b02ba1545b909bad4160425b2d.exe 1992 svchost.exe 1992 svchost.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1364 d77346745325751a39d77202e83af104ed44a7b02ba1545b909bad4160425b2d.exe 1364 d77346745325751a39d77202e83af104ed44a7b02ba1545b909bad4160425b2d.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1364 d77346745325751a39d77202e83af104ed44a7b02ba1545b909bad4160425b2d.exe Token: SeDebugPrivilege 1992 svchost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1364 wrote to memory of 1992 1364 d77346745325751a39d77202e83af104ed44a7b02ba1545b909bad4160425b2d.exe 27 PID 1364 wrote to memory of 1992 1364 d77346745325751a39d77202e83af104ed44a7b02ba1545b909bad4160425b2d.exe 27 PID 1364 wrote to memory of 1992 1364 d77346745325751a39d77202e83af104ed44a7b02ba1545b909bad4160425b2d.exe 27 PID 1364 wrote to memory of 1992 1364 d77346745325751a39d77202e83af104ed44a7b02ba1545b909bad4160425b2d.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\d77346745325751a39d77202e83af104ed44a7b02ba1545b909bad4160425b2d.exe"C:\Users\Admin\AppData\Local\Temp\d77346745325751a39d77202e83af104ed44a7b02ba1545b909bad4160425b2d.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\syswow64\svchost.exe"C:\Windows\syswow64\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1992
-