Analysis
-
max time kernel
180s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 02:37
Static task
static1
Behavioral task
behavioral1
Sample
ac0eb4ea21a9dc18c06e170dd81d3bec81d3b1215a469a66f0b75e1407880f1c.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ac0eb4ea21a9dc18c06e170dd81d3bec81d3b1215a469a66f0b75e1407880f1c.exe
Resource
win10v2004-20221111-en
General
-
Target
ac0eb4ea21a9dc18c06e170dd81d3bec81d3b1215a469a66f0b75e1407880f1c.exe
-
Size
438KB
-
MD5
636f4d3eab91225fa18fe1cfefd70840
-
SHA1
1bd5d9282d21b4bca008a795c6e78df24bbf01b0
-
SHA256
ac0eb4ea21a9dc18c06e170dd81d3bec81d3b1215a469a66f0b75e1407880f1c
-
SHA512
7867a797a0d803723f4b9b8a6700904cc891e7977f58123e010ec7930b1a901b7f83d195624ea80f26b0b98fe2dea382bf3fbe264c7daa0ec4911ce7c709d817
-
SSDEEP
6144:OKmiLuncbmmkHCUwDgt/ZSwLM2f3a6xAEg8ovT9ploCe1O6pRbYxvfT8NYD:LmiGmkHC3s3SwLMAvxAQwjJe7Sr7
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 1520 ac0eb4ea21a9dc18c06e170dd81d3bec81d3b1215a469a66f0b75e1407880f1c.exe 1520 ac0eb4ea21a9dc18c06e170dd81d3bec81d3b1215a469a66f0b75e1407880f1c.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1520 ac0eb4ea21a9dc18c06e170dd81d3bec81d3b1215a469a66f0b75e1407880f1c.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1520 ac0eb4ea21a9dc18c06e170dd81d3bec81d3b1215a469a66f0b75e1407880f1c.exe 1520 ac0eb4ea21a9dc18c06e170dd81d3bec81d3b1215a469a66f0b75e1407880f1c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac0eb4ea21a9dc18c06e170dd81d3bec81d3b1215a469a66f0b75e1407880f1c.exe"C:\Users\Admin\AppData\Local\Temp\ac0eb4ea21a9dc18c06e170dd81d3bec81d3b1215a469a66f0b75e1407880f1c.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1520
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
268KB
MD53dabd305a85cc0009f5eec45b5d670d6
SHA1cdea150a935c43edc3cbb7e42b181fe4bf61273b
SHA256a4f2589fc8246930338cb69e9c77bf4da9c43b1f578cac65ab3ee7cc2701bd58
SHA5125b8123d15e65339fe4382efecf2671819d70705a74bc1a5d319fa0eda4b42398f7aba6880d603db0919ab8c73b54a12e3df8ef096e12b4d1f28802fba0a796d6
-
Filesize
268KB
MD53dabd305a85cc0009f5eec45b5d670d6
SHA1cdea150a935c43edc3cbb7e42b181fe4bf61273b
SHA256a4f2589fc8246930338cb69e9c77bf4da9c43b1f578cac65ab3ee7cc2701bd58
SHA5125b8123d15e65339fe4382efecf2671819d70705a74bc1a5d319fa0eda4b42398f7aba6880d603db0919ab8c73b54a12e3df8ef096e12b4d1f28802fba0a796d6