Analysis
-
max time kernel
185s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 15:59
Static task
static1
Behavioral task
behavioral1
Sample
f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe
Resource
win10v2004-20221111-en
General
-
Target
f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe
-
Size
1.6MB
-
MD5
d725e61af5a2f4970c9719639433d724
-
SHA1
03cabb47fdf087cea32cd71c3f01897ed020d816
-
SHA256
f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd
-
SHA512
a8188db27150531154d324e3b5c19f72d05bd45beb9cb169825a5fc1abee3136bfc149072f29c6566594db2e8313ebed448f8995020f6d32dbe30de7f72dfd24
-
SSDEEP
24576:0oNtDHP3owgLIaIEt8GRDBbFzgfoM3q4at2au5AvprYaTmo2jb6RZfsLypvIH3R:0ADHLgLPt8eTV4QooZfWovIH3R
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 30 IoCs
Processes:
f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exepid process 1048 f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe 1048 f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe 1048 f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe 1048 f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe 1048 f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe 1048 f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe 1048 f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe 1048 f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe 1048 f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe 1048 f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe 1048 f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe 1048 f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe 1048 f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe 1048 f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe 1048 f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe 1048 f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe 1048 f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe 1048 f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe 1048 f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe 1048 f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe 1048 f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe 1048 f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe 1048 f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe 1048 f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe 1048 f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe 1048 f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe 1048 f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe 1048 f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe 1048 f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe 1048 f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exepid process 1048 f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe 1048 f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe"C:\Users\Admin\AppData\Local\Temp\f7e10c861d39a119c320031fb05b073fbb453394164e5ce6da0fb3735bf052dd.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:1048