Analysis
-
max time kernel
195s -
max time network
241s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 20:30
Behavioral task
behavioral1
Sample
fee51477c9805fe9dc1a1cda9c598fa6b853fb60fafce4d4a4a4002a0cf901d3.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
fee51477c9805fe9dc1a1cda9c598fa6b853fb60fafce4d4a4a4002a0cf901d3.exe
Resource
win10v2004-20221111-en
General
-
Target
fee51477c9805fe9dc1a1cda9c598fa6b853fb60fafce4d4a4a4002a0cf901d3.exe
-
Size
612KB
-
MD5
884a33ef39413276cb6d2e29491ad852
-
SHA1
61713c42ce4b3373d74565c095459404677ca25b
-
SHA256
fee51477c9805fe9dc1a1cda9c598fa6b853fb60fafce4d4a4a4002a0cf901d3
-
SHA512
1efec4e0bb48b100260a595608015bf0a4dff8349105f3d67a5d5c657c570399f59f0785aef1a78d7777c0d636da14d7cd65ad9eeb526563f2924b8f8e9ea3b6
-
SSDEEP
12288:gXvVbUISJIl0bwwAMrXUf4lv4+P9EtepRYbcWM635Q+lIn1r1xpZUe84K+gvhH0Z:wNU3c00CrX3vTP91DY3bJQIIn1r1xIen
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4456-133-0x0000000000400000-0x00000000005FE000-memory.dmp vmprotect behavioral2/memory/4456-135-0x0000000000400000-0x00000000005FE000-memory.dmp vmprotect behavioral2/memory/4456-136-0x0000000000400000-0x00000000005FE000-memory.dmp vmprotect -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
fee51477c9805fe9dc1a1cda9c598fa6b853fb60fafce4d4a4a4002a0cf901d3.exepid process 4456 fee51477c9805fe9dc1a1cda9c598fa6b853fb60fafce4d4a4a4002a0cf901d3.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
fee51477c9805fe9dc1a1cda9c598fa6b853fb60fafce4d4a4a4002a0cf901d3.exepid process 4456 fee51477c9805fe9dc1a1cda9c598fa6b853fb60fafce4d4a4a4002a0cf901d3.exe 4456 fee51477c9805fe9dc1a1cda9c598fa6b853fb60fafce4d4a4a4002a0cf901d3.exe 4456 fee51477c9805fe9dc1a1cda9c598fa6b853fb60fafce4d4a4a4002a0cf901d3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fee51477c9805fe9dc1a1cda9c598fa6b853fb60fafce4d4a4a4002a0cf901d3.exe"C:\Users\Admin\AppData\Local\Temp\fee51477c9805fe9dc1a1cda9c598fa6b853fb60fafce4d4a4a4002a0cf901d3.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:4456