Analysis
-
max time kernel
145s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 19:08
Static task
static1
Behavioral task
behavioral1
Sample
bbc4ba600bec97977bd31eb7e1e197c22eeb29266c37f536e6a40e3d4a1ac633.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
bbc4ba600bec97977bd31eb7e1e197c22eeb29266c37f536e6a40e3d4a1ac633.exe
Resource
win10v2004-20221111-en
General
-
Target
bbc4ba600bec97977bd31eb7e1e197c22eeb29266c37f536e6a40e3d4a1ac633.exe
-
Size
2.8MB
-
MD5
a2c9ee7419369ada4d8a41ef14d642a4
-
SHA1
bbeee886e192b807097c22bbaf79483659242d11
-
SHA256
bbc4ba600bec97977bd31eb7e1e197c22eeb29266c37f536e6a40e3d4a1ac633
-
SHA512
0f14717a83583b92ec472c7557cd1d81a95bc66507089aa0cfc785e575a11406aae172f3c95dec61426cbe6848f8a4e4a3e99b9183f351c6bbd5379657a337e1
-
SSDEEP
49152:etQ81S566MD++BLuh7BFQEuQsk9RxsmHpAJr/EnPUk151Fy7b3mAn0JxRvyGoU+T:etQ81ZpD++Buh7L/rxxHpAJCNZYH26x3
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
bbc4ba600bec97977bd31eb7e1e197c22eeb29266c37f536e6a40e3d4a1ac633.exepid process 2636 bbc4ba600bec97977bd31eb7e1e197c22eeb29266c37f536e6a40e3d4a1ac633.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
bbc4ba600bec97977bd31eb7e1e197c22eeb29266c37f536e6a40e3d4a1ac633.exepid process 2636 bbc4ba600bec97977bd31eb7e1e197c22eeb29266c37f536e6a40e3d4a1ac633.exe 2636 bbc4ba600bec97977bd31eb7e1e197c22eeb29266c37f536e6a40e3d4a1ac633.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
bbc4ba600bec97977bd31eb7e1e197c22eeb29266c37f536e6a40e3d4a1ac633.exepid process 2636 bbc4ba600bec97977bd31eb7e1e197c22eeb29266c37f536e6a40e3d4a1ac633.exe 2636 bbc4ba600bec97977bd31eb7e1e197c22eeb29266c37f536e6a40e3d4a1ac633.exe 2636 bbc4ba600bec97977bd31eb7e1e197c22eeb29266c37f536e6a40e3d4a1ac633.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbc4ba600bec97977bd31eb7e1e197c22eeb29266c37f536e6a40e3d4a1ac633.exe"C:\Users\Admin\AppData\Local\Temp\bbc4ba600bec97977bd31eb7e1e197c22eeb29266c37f536e6a40e3d4a1ac633.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2636