Analysis
-
max time kernel
190s -
max time network
197s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 12:49
Static task
static1
Behavioral task
behavioral1
Sample
e886b05c4a0f7f0f5fb69d08bb5e4890b78d547b6145db0732ad9690dcc01773.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e886b05c4a0f7f0f5fb69d08bb5e4890b78d547b6145db0732ad9690dcc01773.exe
Resource
win10v2004-20221111-en
General
-
Target
e886b05c4a0f7f0f5fb69d08bb5e4890b78d547b6145db0732ad9690dcc01773.exe
-
Size
328KB
-
MD5
c22526139e2f818d252a70755787dc3e
-
SHA1
20e0d953742f7e39b6e404260510c12e39c018ba
-
SHA256
e886b05c4a0f7f0f5fb69d08bb5e4890b78d547b6145db0732ad9690dcc01773
-
SHA512
ed0ef90944b84bfe94425f8d77fc2abc0e208aebab12e46c0adac0eeee16fd0bd673613c0c676aba35c9d27c38f1f2851fdbe5e51f94a5564c1eb873121b107d
-
SSDEEP
6144:OIWbEGsxdTGzTb1P6LG/J9hS14sCIFQwaEyUNxYrYBei6C3YVt:OISEGsx68LG/J9h1sQuxYrQUCat
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
e886b05c4a0f7f0f5fb69d08bb5e4890b78d547b6145db0732ad9690dcc01773.exepid process 4432 e886b05c4a0f7f0f5fb69d08bb5e4890b78d547b6145db0732ad9690dcc01773.exe 4432 e886b05c4a0f7f0f5fb69d08bb5e4890b78d547b6145db0732ad9690dcc01773.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
e886b05c4a0f7f0f5fb69d08bb5e4890b78d547b6145db0732ad9690dcc01773.exedescription pid process Token: SeDebugPrivilege 4432 e886b05c4a0f7f0f5fb69d08bb5e4890b78d547b6145db0732ad9690dcc01773.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
e886b05c4a0f7f0f5fb69d08bb5e4890b78d547b6145db0732ad9690dcc01773.exepid process 4432 e886b05c4a0f7f0f5fb69d08bb5e4890b78d547b6145db0732ad9690dcc01773.exe 4432 e886b05c4a0f7f0f5fb69d08bb5e4890b78d547b6145db0732ad9690dcc01773.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e886b05c4a0f7f0f5fb69d08bb5e4890b78d547b6145db0732ad9690dcc01773.exe"C:\Users\Admin\AppData\Local\Temp\e886b05c4a0f7f0f5fb69d08bb5e4890b78d547b6145db0732ad9690dcc01773.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4432
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
496KB
MD56a23beb2b76338c8f124532fdd2c652c
SHA118ee40972642312557ac3ba105b21b009ec4fec6
SHA2561d04c205bbdc77fe29505c16c0ba516ad32ce1b2e02de77910bc632d30ea22eb
SHA512caa57a55b18b1479127191d787bf6324ff444437f220f520e7fe1f1594840320c80e52f283408c628771d8399dbc4555a82651df4bcc730e7453d18e39b60f01
-
Filesize
496KB
MD56a23beb2b76338c8f124532fdd2c652c
SHA118ee40972642312557ac3ba105b21b009ec4fec6
SHA2561d04c205bbdc77fe29505c16c0ba516ad32ce1b2e02de77910bc632d30ea22eb
SHA512caa57a55b18b1479127191d787bf6324ff444437f220f520e7fe1f1594840320c80e52f283408c628771d8399dbc4555a82651df4bcc730e7453d18e39b60f01