Analysis

  • max time kernel
    135s
  • max time network
    164s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-10-2022 23:17

General

  • Target

    f4f28feb4cf6de6a2cdb16dbee94331e92bad422f634eb45e15930c571c0d4d4.exe

  • Size

    556KB

  • MD5

    839d4f4798f10ce9766d0fee97136810

  • SHA1

    9e95b845a8a1a8769af63d218697394ac7ff6927

  • SHA256

    f4f28feb4cf6de6a2cdb16dbee94331e92bad422f634eb45e15930c571c0d4d4

  • SHA512

    8c22e1ed94c6726f944682a734f5eb6452e0acd365133fcf9e09dd7a6a9e25239ad4a81c5c3169d852ab27ac1524f97764abd768a75beaeb73a0a963037316e2

  • SSDEEP

    6144:aN73TeVbl0ZnF0y6oSOtrHX6H5wITUXj/MBZEcmUbPl6d1i2QqQwv4iYS:ySP0ZnFhtSO05ZQj/MzEcKn9Q7wvX

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f4f28feb4cf6de6a2cdb16dbee94331e92bad422f634eb45e15930c571c0d4d4.exe
    "C:\Users\Admin\AppData\Local\Temp\f4f28feb4cf6de6a2cdb16dbee94331e92bad422f634eb45e15930c571c0d4d4.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\dfsB8F4.tmp

    Filesize

    306KB

    MD5

    3ca0638e7119f63f2b6fc7426b3b0f8f

    SHA1

    fa699c3cb5ec74cfc8ebdade3a8a3dc014c29582

    SHA256

    82fcb7e72f5bee64eecbf9c1e553d65374951ffccaaa07d5848d624d732d40cf

    SHA512

    0769d88beb6fafe83bcc9176fc7892b8ba9c4a02be37129a57dc6513472b245179afea1abad161179414ef625890e1e8f6ac76d1d907887fe73f0ddb140e61e8

  • C:\Users\Admin\AppData\Local\Temp\dfsB8F4.tmp

    Filesize

    306KB

    MD5

    3ca0638e7119f63f2b6fc7426b3b0f8f

    SHA1

    fa699c3cb5ec74cfc8ebdade3a8a3dc014c29582

    SHA256

    82fcb7e72f5bee64eecbf9c1e553d65374951ffccaaa07d5848d624d732d40cf

    SHA512

    0769d88beb6fafe83bcc9176fc7892b8ba9c4a02be37129a57dc6513472b245179afea1abad161179414ef625890e1e8f6ac76d1d907887fe73f0ddb140e61e8

  • memory/4516-134-0x0000000005180000-0x00000000051D2000-memory.dmp

    Filesize

    328KB

  • memory/4516-135-0x0000000005900000-0x0000000005EA4000-memory.dmp

    Filesize

    5.6MB

  • memory/4516-136-0x0000000005400000-0x0000000005492000-memory.dmp

    Filesize

    584KB

  • memory/4516-137-0x00000000055C0000-0x00000000055CA000-memory.dmp

    Filesize

    40KB

  • memory/4516-138-0x0000000009580000-0x00000000095E6000-memory.dmp

    Filesize

    408KB

  • memory/4516-139-0x000000000E740000-0x000000000EEE6000-memory.dmp

    Filesize

    7.6MB