Analysis

  • max time kernel
    139s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2022, 14:56

General

  • Target

    a0d858b76339c4932ac52fcde2eaf2b36da63ee6a93f5a91011148f8fccb918d.exe

  • Size

    362KB

  • MD5

    049598a6c143e7f6246ae53a99f6f740

  • SHA1

    d565f9ab803e1f870aea033897bceb1f95432a1c

  • SHA256

    a0d858b76339c4932ac52fcde2eaf2b36da63ee6a93f5a91011148f8fccb918d

  • SHA512

    65b50d876627080be003839fa152bdec74e7425542a135aa2ea2332981a3e7dd53a648ba66d2b3ef06b19a8d43eb9051ef63a4c63c7ddff92e4d5cecb63e3551

  • SSDEEP

    6144:7hqubAERRedLzVxwl0888U/Ob+50jFZ3mRV6OrCSy78cVhAb2Y5:1qu8oRedHVOl0888U/Oy5+26QiDy

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a0d858b76339c4932ac52fcde2eaf2b36da63ee6a93f5a91011148f8fccb918d.exe
    "C:\Users\Admin\AppData\Local\Temp\a0d858b76339c4932ac52fcde2eaf2b36da63ee6a93f5a91011148f8fccb918d.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1884

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\weeC0D4.tmp

          Filesize

          258KB

          MD5

          9225cd6a93a735e7561f0276ce9e6b9c

          SHA1

          79172d1ceba038b651bd31ca5e0f81070a6e5cf2

          SHA256

          38f980db7e6a55d8a7a1f4d7cc1cfd973a516dd25f3b4d6d969ca4b5b114a025

          SHA512

          d364a86a7fde64186684d390df3985032b6afb2fced95dd3bc42356f35465b04360933289392a2a249de1b0cab0d7c5666302e7c1db449534e5cb1a1db392a0e

        • C:\Users\Admin\AppData\Local\Temp\weeC0D4.tmp

          Filesize

          258KB

          MD5

          9225cd6a93a735e7561f0276ce9e6b9c

          SHA1

          79172d1ceba038b651bd31ca5e0f81070a6e5cf2

          SHA256

          38f980db7e6a55d8a7a1f4d7cc1cfd973a516dd25f3b4d6d969ca4b5b114a025

          SHA512

          d364a86a7fde64186684d390df3985032b6afb2fced95dd3bc42356f35465b04360933289392a2a249de1b0cab0d7c5666302e7c1db449534e5cb1a1db392a0e

        • memory/1884-134-0x0000000004DD0000-0x0000000004E16000-memory.dmp

          Filesize

          280KB

        • memory/1884-135-0x0000000007540000-0x0000000007AE4000-memory.dmp

          Filesize

          5.6MB

        • memory/1884-136-0x0000000007070000-0x0000000007102000-memory.dmp

          Filesize

          584KB

        • memory/1884-137-0x0000000007210000-0x000000000721A000-memory.dmp

          Filesize

          40KB

        • memory/1884-138-0x000000000B1B0000-0x000000000B216000-memory.dmp

          Filesize

          408KB

        • memory/1884-139-0x0000000010390000-0x0000000010B36000-memory.dmp

          Filesize

          7.6MB