Analysis
-
max time kernel
112s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-10-2022 04:43
Static task
static1
Behavioral task
behavioral1
Sample
037354e9ffc64b74df6585ec6409b9d0114a4e7a3740eb19047ee06452923c9a.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
037354e9ffc64b74df6585ec6409b9d0114a4e7a3740eb19047ee06452923c9a.exe
Resource
win10v2004-20220812-en
General
-
Target
037354e9ffc64b74df6585ec6409b9d0114a4e7a3740eb19047ee06452923c9a.exe
-
Size
2.0MB
-
MD5
b840498b8e287f603675aa7f1d97c6d0
-
SHA1
d7f6880fdda5d041af68ee61e11e66c26832d52f
-
SHA256
037354e9ffc64b74df6585ec6409b9d0114a4e7a3740eb19047ee06452923c9a
-
SHA512
b3f477646594a8845f41943bd48806c400973e01c3be4ae89268e661931a39cd95312374b48cddbd2c53d6596b1a04b1d3030e86e6f8ed12865e2c77955604c7
-
SSDEEP
49152:260FEMdfbV+X/anvdkIxyuYRp6tF509BcjvsqvxVKbS:260/dh+IvpoXYtHTvxkbS
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 5052 037354e9ffc64b74df6585ec6409b9d0114a4e7a3740eb19047ee06452923c9a.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 5052 037354e9ffc64b74df6585ec6409b9d0114a4e7a3740eb19047ee06452923c9a.exe 5052 037354e9ffc64b74df6585ec6409b9d0114a4e7a3740eb19047ee06452923c9a.exe 5052 037354e9ffc64b74df6585ec6409b9d0114a4e7a3740eb19047ee06452923c9a.exe 5052 037354e9ffc64b74df6585ec6409b9d0114a4e7a3740eb19047ee06452923c9a.exe 5052 037354e9ffc64b74df6585ec6409b9d0114a4e7a3740eb19047ee06452923c9a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\037354e9ffc64b74df6585ec6409b9d0114a4e7a3740eb19047ee06452923c9a.exe"C:\Users\Admin\AppData\Local\Temp\037354e9ffc64b74df6585ec6409b9d0114a4e7a3740eb19047ee06452923c9a.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:5052