Analysis

  • max time kernel
    136s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-10-2022 23:13

General

  • Target

    8177aba4759b8e10fb6bbf7c0948c973028bf7e6be9a2d78019d6d721e153906.exe

  • Size

    13KB

  • MD5

    621a06b7a728836e6754109400490cf3

  • SHA1

    f1d8dd147ba5d78023e5fbc222c39339e1a4e1c9

  • SHA256

    8177aba4759b8e10fb6bbf7c0948c973028bf7e6be9a2d78019d6d721e153906

  • SHA512

    45fac9bc29b82f8121031045af76e921d426d165f6d02931dcddbef0011246db75120dc054a42bac0bba2f69ad1761d98ed818445a59d3c97efc65cb86533a94

  • SSDEEP

    192:fkJPOmwlDu3KTWbiUq6q82TgNJsMrCA6D5wMD+:fkxCDMkWwf820NJsMrtiD

Malware Config

Signatures

  • joker

    Joker is an Android malware that targets billing and SMS fraud.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8177aba4759b8e10fb6bbf7c0948c973028bf7e6be9a2d78019d6d721e153906.exe
    "C:\Users\Admin\AppData\Local\Temp\8177aba4759b8e10fb6bbf7c0948c973028bf7e6be9a2d78019d6d721e153906.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5064-132-0x00000000005C0000-0x00000000005CA000-memory.dmp

    Filesize

    40KB

  • memory/5064-133-0x0000000005480000-0x0000000005A24000-memory.dmp

    Filesize

    5.6MB

  • memory/5064-134-0x0000000004F70000-0x0000000005002000-memory.dmp

    Filesize

    584KB

  • memory/5064-135-0x0000000005120000-0x000000000512A000-memory.dmp

    Filesize

    40KB