Analysis

  • max time kernel
    38s
  • max time network
    50s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    06/11/2022, 09:05

General

  • Target

    447f0886f98499a125784b449f8c6541f867b84100faa5a5e603099dd898a066.exe

  • Size

    104KB

  • MD5

    19ddc233a9badcd04e49bd09152e0710

  • SHA1

    bf1e28bb68e334fe2ad3b61ba8a874d1899a88b2

  • SHA256

    447f0886f98499a125784b449f8c6541f867b84100faa5a5e603099dd898a066

  • SHA512

    bd96b71f7b1f6218979af103c9f641c408e847563de40e6f5f2614469b78193cbe0691f476885efc14f52de81764fb70bfa61957092dd392f8c4526a4033105b

  • SSDEEP

    1536:xDQpQ5EP0ijnP1Mu+owNjfyBj4FRf8FAKFm9bIabXo7b1jXssG8WXYv:lQIUP1M9oEjKBj4z0mBIGXEhXs

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\447f0886f98499a125784b449f8c6541f867b84100faa5a5e603099dd898a066.exe
    "C:\Users\Admin\AppData\Local\Temp\447f0886f98499a125784b449f8c6541f867b84100faa5a5e603099dd898a066.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: MapViewOfSection
    PID:1632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1216-57-0x0000000077280000-0x0000000077429000-memory.dmp

    Filesize

    1.7MB

  • memory/1632-54-0x0000000000400000-0x0000000000C36000-memory.dmp

    Filesize

    8.2MB

  • memory/1632-55-0x0000000000400000-0x0000000000C36000-memory.dmp

    Filesize

    8.2MB

  • memory/1632-56-0x0000000000400000-0x0000000000C36000-memory.dmp

    Filesize

    8.2MB