Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 10:19
Behavioral task
behavioral1
Sample
18a2f191db62cc45601981180e6263c46657f537e0842cbc350a47efaa775178.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
18a2f191db62cc45601981180e6263c46657f537e0842cbc350a47efaa775178.exe
Resource
win10v2004-20221111-en
General
-
Target
18a2f191db62cc45601981180e6263c46657f537e0842cbc350a47efaa775178.exe
-
Size
1.5MB
-
MD5
37e2490d6c9391fe81043eeb7cfa637a
-
SHA1
6cdbd359838b7213f2958717b914b1ac4157408c
-
SHA256
18a2f191db62cc45601981180e6263c46657f537e0842cbc350a47efaa775178
-
SHA512
fa76cdc67dbd8b2dab4d4aa835aa721f091c48b1ee0701102da9dd7fd8ae906da088f93d3626ce6a77a06cec4706e0eeb8eef60c3984d6b2c31b6bc670818e9d
-
SSDEEP
24576:BHA4Egl3XxnHjkn7ASzCxvB0lpVNulA8QNUG72mesjWuvTrE7xosTkEozWO2bWn:UW3XxHjiHrDulA8VG7v2SrE9b7wW3q
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3352-132-0x00007FF7DC3D0000-0x00007FF7DC795000-memory.dmp vmprotect behavioral2/memory/3352-133-0x00007FF7DC3D0000-0x00007FF7DC795000-memory.dmp vmprotect behavioral2/memory/3352-136-0x00007FF7DC3D0000-0x00007FF7DC795000-memory.dmp vmprotect -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
18a2f191db62cc45601981180e6263c46657f537e0842cbc350a47efaa775178.exepid process 3352 18a2f191db62cc45601981180e6263c46657f537e0842cbc350a47efaa775178.exe