571fdba3497a39c7a202753e671f5002323a302d895a8d1862419622953e1c6a

Analysis

max time kernel
47s
max time network
71s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

雷霆之怒夜涩辅助V2.3/edison.exe
Size

3.8MB
MD5

518f36099e6526c41e44ccfdf2665a99
SHA1

acb3288e67fd5381ef6d89ba6031a623c535c481
SHA256

e14eaf02998acd6c3ae092c1f6a62377e64add5ed410096df693388694cb19c4
SHA512

e1977eff04ea4fcfc19a119f37cf165b945662cf858e2cb918ec9f8716e354657c545ac2fc8f3e96a239978589d1ff88e6571db47020d7ca8e4d127618bcf478
SSDEEP

98304:hUlRr8eWMeymfqEbW5UAGAD2jMjtDTu+jrrc+:hO81Me6SrAMMZfu2H

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

Processes:

edison.exe

pid process

1480 edison.exe
1480 edison.exe
1480 edison.exe
1480 edison.exe
1480 edison.exe
1480 edison.exe
1480 edison.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

edison.exe

pid process

1480 edison.exe
1480 edison.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

edison.exe

description pid process

Token: SeDebugPrivilege 1480 edison.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

edison.exe

pid process

1480 edison.exe
1480 edison.exe
1480 edison.exe
1480 edison.exe
1480 edison.exe

pid	process
1480	edison.exe
1480	edison.exe
1480	edison.exe
1480	edison.exe
1480	edison.exe
1480	edison.exe
1480	edison.exe

pid	process
1480	edison.exe
1480	edison.exe

description	pid	process
Token: SeDebugPrivilege	1480	edison.exe

pid	process
1480	edison.exe
1480	edison.exe
1480	edison.exe
1480	edison.exe
1480	edison.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

edison.exe

description	pid	process	target process
PID 1480 wrote to memory of 944	1480	edison.exe	edison.exe
PID 1480 wrote to memory of 944	1480	edison.exe	edison.exe
PID 1480 wrote to memory of 944	1480	edison.exe	edison.exe
PID 1480 wrote to memory of 944	1480	edison.exe	edison.exe

C:\Users\Admin\AppData\Local\Temp\雷霆之怒夜涩辅助V2.3\edison.exe
"C:\Users\Admin\AppData\Local\Temp\雷霆之怒夜涩辅助V2.3\edison.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480

C:\Users\Admin\AppData\Local\Temp\雷霆之怒夜涩辅助V2.3\edison.exe
"C:\Users\Admin\AppData\Local\Temp\雷霆之怒夜涩辅助V2.3\edison.exe"
2⤵
PID:944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/944-5081-0x0000000000400000-0x000000000091F000-memory.dmp

Filesize
5.1MB

Download
memory/1480-54-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download
memory/1480-55-0x0000000000400000-0x000000000091F000-memory.dmp

Filesize
5.1MB

Download
memory/1480-57-0x00000000775B0000-0x00000000775F7000-memory.dmp

Filesize
284KB

Download
memory/1480-464-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-465-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-466-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-467-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-469-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-472-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-471-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-470-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-468-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-473-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-474-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-475-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-476-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-477-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-478-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-479-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-480-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-481-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-482-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-483-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-484-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-485-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-486-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-487-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-488-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-489-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-490-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-491-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-492-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-493-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-494-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-495-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-496-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-497-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-498-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-499-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-500-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-501-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-502-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-503-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-505-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-504-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-506-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-507-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-508-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-509-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-510-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-512-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-511-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-514-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-515-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-513-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-516-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-517-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-518-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-519-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-520-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-521-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-522-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-523-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-524-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-525-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-1566-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-1567-0x0000000002480000-0x0000000002601000-memory.dmp

Filesize
1.5MB

Download
memory/1480-3600-0x000000000273A000-0x000000000273C000-memory.dmp

Filesize
8KB

Download
memory/1480-3602-0x000000000273A000-0x000000000273C000-memory.dmp

Filesize
8KB

Download
memory/1480-3850-0x0000000002300000-0x0000000002400000-memory.dmp

Filesize
1024KB

Download
memory/1480-4614-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-5087-0x0000000002B60000-0x000000000307F000-memory.dmp

Filesize
5.1MB

Download
memory/1480-5088-0x0000000002850000-0x0000000002951000-memory.dmp

Filesize
1.0MB

Download
memory/1480-5089-0x0000000000400000-0x000000000091F000-memory.dmp

Filesize
5.1MB

Download
memory/1480-5090-0x0000000000400000-0x000000000091F000-memory.dmp

Filesize
5.1MB

Download
memory/1480-5092-0x0000000002730000-0x0000000002841000-memory.dmp

Filesize
1.1MB

Download
memory/1480-5091-0x000000000273A000-0x000000000273C000-memory.dmp

Filesize
8KB

Download