Analysis

  • max time kernel
    190s
  • max time network
    197s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 12:49

General

  • Target

    e886b05c4a0f7f0f5fb69d08bb5e4890b78d547b6145db0732ad9690dcc01773.exe

  • Size

    328KB

  • MD5

    c22526139e2f818d252a70755787dc3e

  • SHA1

    20e0d953742f7e39b6e404260510c12e39c018ba

  • SHA256

    e886b05c4a0f7f0f5fb69d08bb5e4890b78d547b6145db0732ad9690dcc01773

  • SHA512

    ed0ef90944b84bfe94425f8d77fc2abc0e208aebab12e46c0adac0eeee16fd0bd673613c0c676aba35c9d27c38f1f2851fdbe5e51f94a5564c1eb873121b107d

  • SSDEEP

    6144:OIWbEGsxdTGzTb1P6LG/J9hS14sCIFQwaEyUNxYrYBei6C3YVt:OISEGsx68LG/J9h1sQuxYrQUCat

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e886b05c4a0f7f0f5fb69d08bb5e4890b78d547b6145db0732ad9690dcc01773.exe
    "C:\Users\Admin\AppData\Local\Temp\e886b05c4a0f7f0f5fb69d08bb5e4890b78d547b6145db0732ad9690dcc01773.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\dfs3CF9.tmp

    Filesize

    496KB

    MD5

    6a23beb2b76338c8f124532fdd2c652c

    SHA1

    18ee40972642312557ac3ba105b21b009ec4fec6

    SHA256

    1d04c205bbdc77fe29505c16c0ba516ad32ce1b2e02de77910bc632d30ea22eb

    SHA512

    caa57a55b18b1479127191d787bf6324ff444437f220f520e7fe1f1594840320c80e52f283408c628771d8399dbc4555a82651df4bcc730e7453d18e39b60f01

  • C:\Users\Admin\AppData\Local\Temp\dfs3CF9.tmp

    Filesize

    496KB

    MD5

    6a23beb2b76338c8f124532fdd2c652c

    SHA1

    18ee40972642312557ac3ba105b21b009ec4fec6

    SHA256

    1d04c205bbdc77fe29505c16c0ba516ad32ce1b2e02de77910bc632d30ea22eb

    SHA512

    caa57a55b18b1479127191d787bf6324ff444437f220f520e7fe1f1594840320c80e52f283408c628771d8399dbc4555a82651df4bcc730e7453d18e39b60f01

  • memory/4432-132-0x0000000000A30000-0x0000000000B02000-memory.dmp

    Filesize

    840KB

  • memory/4432-133-0x00000000006B0000-0x00000000006B3000-memory.dmp

    Filesize

    12KB

  • memory/4432-136-0x0000000004B70000-0x0000000004BF2000-memory.dmp

    Filesize

    520KB

  • memory/4432-137-0x0000000005610000-0x0000000005BB4000-memory.dmp

    Filesize

    5.6MB

  • memory/4432-138-0x0000000005100000-0x0000000005192000-memory.dmp

    Filesize

    584KB

  • memory/4432-139-0x00000000050B0000-0x00000000050BA000-memory.dmp

    Filesize

    40KB

  • memory/4432-140-0x0000000008FE0000-0x0000000009046000-memory.dmp

    Filesize

    408KB

  • memory/4432-141-0x00000000006B0000-0x00000000006B3000-memory.dmp

    Filesize

    12KB

  • memory/4432-142-0x0000000000A30000-0x0000000000B02000-memory.dmp

    Filesize

    840KB

  • memory/4432-143-0x000000000DE80000-0x000000000E626000-memory.dmp

    Filesize

    7.6MB