db080dd894de43b23498ea575163900e75ab277f8a4b5cf3b9749e4e8ac9b9dd

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db080dd894de43b23498ea575163900e75ab277f8a4b5cf3b9749e4e8ac9b9dd.exe
Size

328KB
MD5

3a391c47a5be3b2355131a1341d49a76
SHA1

e6fb4f4f484a728de3efae502da6e3ff6839e983
SHA256

db080dd894de43b23498ea575163900e75ab277f8a4b5cf3b9749e4e8ac9b9dd
SHA512

a9973351adc7165bf68d31665378ebb1f0cfe187d05412e9646b892fab891844af4344d4adf689cf9b49cc23db5aee617607df94a4229014a48df8f22302ab0c
SSDEEP

6144:eIWbEGsxdTGzTb1P6LG/J9hS14sCIFQwaEyUNxYrYBei6Cu0YP:eISEGsx68LG/J9h1sQuxYrQUCE

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

db080dd894de43b23498ea575163900e75ab277f8a4b5cf3b9749e4e8ac9b9dd.exe

pid	process
976	db080dd894de43b23498ea575163900e75ab277f8a4b5cf3b9749e4e8ac9b9dd.exe
976	db080dd894de43b23498ea575163900e75ab277f8a4b5cf3b9749e4e8ac9b9dd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

db080dd894de43b23498ea575163900e75ab277f8a4b5cf3b9749e4e8ac9b9dd.exe

description pid process

Token: SeDebugPrivilege 976 db080dd894de43b23498ea575163900e75ab277f8a4b5cf3b9749e4e8ac9b9dd.exe

description	pid	process
Token: SeDebugPrivilege	976	db080dd894de43b23498ea575163900e75ab277f8a4b5cf3b9749e4e8ac9b9dd.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

db080dd894de43b23498ea575163900e75ab277f8a4b5cf3b9749e4e8ac9b9dd.exe

pid	process
976	db080dd894de43b23498ea575163900e75ab277f8a4b5cf3b9749e4e8ac9b9dd.exe
976	db080dd894de43b23498ea575163900e75ab277f8a4b5cf3b9749e4e8ac9b9dd.exe

C:\Users\Admin\AppData\Local\Temp\db080dd894de43b23498ea575163900e75ab277f8a4b5cf3b9749e4e8ac9b9dd.exe
"C:\Users\Admin\AppData\Local\Temp\db080dd894de43b23498ea575163900e75ab277f8a4b5cf3b9749e4e8ac9b9dd.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dfs985D.tmp
Filesize
496KB

MD5
6a23beb2b76338c8f124532fdd2c652c

SHA1
18ee40972642312557ac3ba105b21b009ec4fec6

SHA256
1d04c205bbdc77fe29505c16c0ba516ad32ce1b2e02de77910bc632d30ea22eb

SHA512
caa57a55b18b1479127191d787bf6324ff444437f220f520e7fe1f1594840320c80e52f283408c628771d8399dbc4555a82651df4bcc730e7453d18e39b60f01

Download Submit
C:\Users\Admin\AppData\Local\Temp\dfs985D.tmp
Filesize
496KB

MD5
6a23beb2b76338c8f124532fdd2c652c

SHA1
18ee40972642312557ac3ba105b21b009ec4fec6

SHA256
1d04c205bbdc77fe29505c16c0ba516ad32ce1b2e02de77910bc632d30ea22eb

SHA512
caa57a55b18b1479127191d787bf6324ff444437f220f520e7fe1f1594840320c80e52f283408c628771d8399dbc4555a82651df4bcc730e7453d18e39b60f01

Download Submit
memory/976-132-0x0000000000130000-0x0000000000202000-memory.dmp

Filesize
840KB

Download
memory/976-133-0x00000000009F0000-0x00000000009F3000-memory.dmp

Filesize
12KB

Download
memory/976-136-0x0000000004D50000-0x0000000004DD2000-memory.dmp

Filesize
520KB

Download
memory/976-137-0x0000000005760000-0x0000000005D04000-memory.dmp

Filesize
5.6MB

Download
memory/976-138-0x0000000005290000-0x0000000005322000-memory.dmp

Filesize
584KB

Download
memory/976-139-0x0000000005270000-0x000000000527A000-memory.dmp

Filesize
40KB

Download
memory/976-140-0x00000000093B0000-0x0000000009416000-memory.dmp

Filesize
408KB

Download
memory/976-141-0x000000000E590000-0x000000000ED36000-memory.dmp

Filesize
7.6MB

Download
memory/976-142-0x00000000009F0000-0x00000000009F3000-memory.dmp

Filesize
12KB

Download