Analysis
-
max time kernel
151s -
max time network
178s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24/11/2022, 05:17
Static task
static1
Behavioral task
behavioral1
Sample
346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
Resource
win10v2004-20221111-en
General
-
Target
346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
-
Size
1.5MB
-
MD5
93b7591aea0b3c85d62c297442065c1a
-
SHA1
8a897af1325f01f80563e93ed3fec4c9edea60fa
-
SHA256
346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80
-
SHA512
b9055c678ac6963b80a8d5f9c486b9c7d8d82fba0fcd61e633c480a6b53f2034b7e0dae87ae3c8e751dfbcf2739440fece7767ff1aeb747402f5d65ff7f7846c
-
SSDEEP
24576:yFKFSnNeFxih0aX1qC6OqnDoURqtVWAuZJK2MJZmrrXuoC/lwHMTAVyNpL3RV6NQ:ymwNeFxe021u9ZwWnZJK5JcrrI/+sTA2
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
pid Process 2052 346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe 2052 346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe 2052 346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe 2052 346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe 2052 346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe 2052 346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe 2052 346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe 2052 346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe 2052 346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe 2052 346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe 2052 346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe 2052 346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe 2052 346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe 2052 346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2052 346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe 2052 346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe 2052 346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe 2052 346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe"C:\Users\Admin\AppData\Local\Temp\346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2052