Analysis
-
max time kernel
47s -
max time network
53s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 10:19
Behavioral task
behavioral1
Sample
18a2f191db62cc45601981180e6263c46657f537e0842cbc350a47efaa775178.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
18a2f191db62cc45601981180e6263c46657f537e0842cbc350a47efaa775178.exe
Resource
win10v2004-20221111-en
General
-
Target
18a2f191db62cc45601981180e6263c46657f537e0842cbc350a47efaa775178.exe
-
Size
1.5MB
-
MD5
37e2490d6c9391fe81043eeb7cfa637a
-
SHA1
6cdbd359838b7213f2958717b914b1ac4157408c
-
SHA256
18a2f191db62cc45601981180e6263c46657f537e0842cbc350a47efaa775178
-
SHA512
fa76cdc67dbd8b2dab4d4aa835aa721f091c48b1ee0701102da9dd7fd8ae906da088f93d3626ce6a77a06cec4706e0eeb8eef60c3984d6b2c31b6bc670818e9d
-
SSDEEP
24576:BHA4Egl3XxnHjkn7ASzCxvB0lpVNulA8QNUG72mesjWuvTrE7xosTkEozWO2bWn:UW3XxHjiHrDulA8VG7v2SrE9b7wW3q
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1364-54-0x000000013FAB0000-0x000000013FE75000-memory.dmp vmprotect behavioral1/memory/1364-57-0x000000013FAB0000-0x000000013FE75000-memory.dmp vmprotect behavioral1/memory/1364-58-0x000000013FAB0000-0x000000013FE75000-memory.dmp vmprotect -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
18a2f191db62cc45601981180e6263c46657f537e0842cbc350a47efaa775178.exepid process 1364 18a2f191db62cc45601981180e6263c46657f537e0842cbc350a47efaa775178.exe