Analysis

  • max time kernel
    180s
  • max time network
    189s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-11-2022 02:37

General

  • Target

    ac0eb4ea21a9dc18c06e170dd81d3bec81d3b1215a469a66f0b75e1407880f1c.exe

  • Size

    438KB

  • MD5

    636f4d3eab91225fa18fe1cfefd70840

  • SHA1

    1bd5d9282d21b4bca008a795c6e78df24bbf01b0

  • SHA256

    ac0eb4ea21a9dc18c06e170dd81d3bec81d3b1215a469a66f0b75e1407880f1c

  • SHA512

    7867a797a0d803723f4b9b8a6700904cc891e7977f58123e010ec7930b1a901b7f83d195624ea80f26b0b98fe2dea382bf3fbe264c7daa0ec4911ce7c709d817

  • SSDEEP

    6144:OKmiLuncbmmkHCUwDgt/ZSwLM2f3a6xAEg8ovT9ploCe1O6pRbYxvfT8NYD:LmiGmkHC3s3SwLMAvxAQwjJe7Sr7

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ac0eb4ea21a9dc18c06e170dd81d3bec81d3b1215a469a66f0b75e1407880f1c.exe
    "C:\Users\Admin\AppData\Local\Temp\ac0eb4ea21a9dc18c06e170dd81d3bec81d3b1215a469a66f0b75e1407880f1c.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\jki1964.tmp

    Filesize

    268KB

    MD5

    3dabd305a85cc0009f5eec45b5d670d6

    SHA1

    cdea150a935c43edc3cbb7e42b181fe4bf61273b

    SHA256

    a4f2589fc8246930338cb69e9c77bf4da9c43b1f578cac65ab3ee7cc2701bd58

    SHA512

    5b8123d15e65339fe4382efecf2671819d70705a74bc1a5d319fa0eda4b42398f7aba6880d603db0919ab8c73b54a12e3df8ef096e12b4d1f28802fba0a796d6

  • C:\Users\Admin\AppData\Local\Temp\jki1964.tmp

    Filesize

    268KB

    MD5

    3dabd305a85cc0009f5eec45b5d670d6

    SHA1

    cdea150a935c43edc3cbb7e42b181fe4bf61273b

    SHA256

    a4f2589fc8246930338cb69e9c77bf4da9c43b1f578cac65ab3ee7cc2701bd58

    SHA512

    5b8123d15e65339fe4382efecf2671819d70705a74bc1a5d319fa0eda4b42398f7aba6880d603db0919ab8c73b54a12e3df8ef096e12b4d1f28802fba0a796d6

  • memory/1520-134-0x0000000004D50000-0x0000000004D98000-memory.dmp

    Filesize

    288KB

  • memory/1520-135-0x00000000056A0000-0x0000000005C44000-memory.dmp

    Filesize

    5.6MB

  • memory/1520-136-0x0000000004FD0000-0x0000000005062000-memory.dmp

    Filesize

    584KB

  • memory/1520-137-0x0000000005070000-0x000000000507A000-memory.dmp

    Filesize

    40KB

  • memory/1520-138-0x0000000009100000-0x0000000009166000-memory.dmp

    Filesize

    408KB

  • memory/1520-139-0x000000000E300000-0x000000000EAA6000-memory.dmp

    Filesize

    7.6MB