Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06-11-2022 07:44
Behavioral task
behavioral1
Sample
32d4216d4ef2af912921fc2931c0bd88.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
32d4216d4ef2af912921fc2931c0bd88.exe
Resource
win10v2004-20220812-en
General
-
Target
32d4216d4ef2af912921fc2931c0bd88.exe
-
Size
1.4MB
-
MD5
32d4216d4ef2af912921fc2931c0bd88
-
SHA1
3e79dd260b67ed27134246e9461d8878c7ac73e3
-
SHA256
d1ecf0f3592c06329182cbcd25fa654bb48c441c0b54bfb5c4b40fbaa517cdbf
-
SHA512
7a25bcf3954238ab946ce95dc4153518fe67e773845f2bd037eac64c93906223b3ec611a04160cc20f85c4afa0b7124c8eacb43667ecb3fdde2776698f5b2b37
-
SSDEEP
24576:SndRKZCy2BrhCeU2i2cJijFbCBTPmiY05tJMSQp5ysA7Yg1nLkzmmKNLyEi93L2:EXDFBU2iIBb0xY/6sUYYMKns0
Malware Config
Extracted
bitrat
1.38
nicehash.at:6000
-
communication_password
005f16f264f006578c55237781f36898
-
install_dir
JavaHelper
-
install_file
Java.exe
-
tor_process
tor
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1976-55-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1976-57-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
32d4216d4ef2af912921fc2931c0bd88.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Java = "C:\\Users\\Admin\\AppData\\Local\\JavaHelper\\Java.exe" 32d4216d4ef2af912921fc2931c0bd88.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
32d4216d4ef2af912921fc2931c0bd88.exepid process 1976 32d4216d4ef2af912921fc2931c0bd88.exe 1976 32d4216d4ef2af912921fc2931c0bd88.exe 1976 32d4216d4ef2af912921fc2931c0bd88.exe 1976 32d4216d4ef2af912921fc2931c0bd88.exe 1976 32d4216d4ef2af912921fc2931c0bd88.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
32d4216d4ef2af912921fc2931c0bd88.exepid process 1976 32d4216d4ef2af912921fc2931c0bd88.exe 1976 32d4216d4ef2af912921fc2931c0bd88.exe 1976 32d4216d4ef2af912921fc2931c0bd88.exe 1976 32d4216d4ef2af912921fc2931c0bd88.exe 1976 32d4216d4ef2af912921fc2931c0bd88.exe 1976 32d4216d4ef2af912921fc2931c0bd88.exe 1976 32d4216d4ef2af912921fc2931c0bd88.exe 1976 32d4216d4ef2af912921fc2931c0bd88.exe 1976 32d4216d4ef2af912921fc2931c0bd88.exe 1976 32d4216d4ef2af912921fc2931c0bd88.exe 1976 32d4216d4ef2af912921fc2931c0bd88.exe 1976 32d4216d4ef2af912921fc2931c0bd88.exe 1976 32d4216d4ef2af912921fc2931c0bd88.exe 1976 32d4216d4ef2af912921fc2931c0bd88.exe 1976 32d4216d4ef2af912921fc2931c0bd88.exe 1976 32d4216d4ef2af912921fc2931c0bd88.exe 1976 32d4216d4ef2af912921fc2931c0bd88.exe 1976 32d4216d4ef2af912921fc2931c0bd88.exe 1976 32d4216d4ef2af912921fc2931c0bd88.exe 1976 32d4216d4ef2af912921fc2931c0bd88.exe 1976 32d4216d4ef2af912921fc2931c0bd88.exe 1976 32d4216d4ef2af912921fc2931c0bd88.exe 1976 32d4216d4ef2af912921fc2931c0bd88.exe 1976 32d4216d4ef2af912921fc2931c0bd88.exe 1976 32d4216d4ef2af912921fc2931c0bd88.exe 1976 32d4216d4ef2af912921fc2931c0bd88.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
32d4216d4ef2af912921fc2931c0bd88.exedescription pid process Token: SeDebugPrivilege 1976 32d4216d4ef2af912921fc2931c0bd88.exe Token: SeShutdownPrivilege 1976 32d4216d4ef2af912921fc2931c0bd88.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
32d4216d4ef2af912921fc2931c0bd88.exepid process 1976 32d4216d4ef2af912921fc2931c0bd88.exe 1976 32d4216d4ef2af912921fc2931c0bd88.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\32d4216d4ef2af912921fc2931c0bd88.exe"C:\Users\Admin\AppData\Local\Temp\32d4216d4ef2af912921fc2931c0bd88.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1976