Analysis
-
max time kernel
151s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
25-11-2022 11:54
General
-
Target
066b913c144499e82ec4940f69e0c9808ec67bcf1286444bd1a354574d5fe0d8.exe
-
Size
6.7MB
-
MD5
fa8b4a926c4a92d9c7030754507a3b43
-
SHA1
9dd10cf6d3f62ca0c5442098d7384638745865f7
-
SHA256
066b913c144499e82ec4940f69e0c9808ec67bcf1286444bd1a354574d5fe0d8
-
SHA512
6eff68adbdbc2a2ebceb1d13471864f29b4a57e7475e171e44f516e772b9ffc44d55813ac624f9331dbbf5a0d1847c3fda6557ac48224528fdd05b706f35975c
-
SSDEEP
196608:zowzVD6ParFwZnAVkPHPtblKA+qTIlNrTuxm:zbGaRAPHK7Nra
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\066b913c144499e82ec4940f69e0c9808ec67bcf1286444bd1a354574d5fe0d8.exe"C:\Users\Admin\AppData\Local\Temp\066b913c144499e82ec4940f69e0c9808ec67bcf1286444bd1a354574d5fe0d8.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xlng.tmpC:\Users\Admin\AppData\Local\Temp\xlng.tmp2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f8 0x2f41⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD550b1f557ab4bfadde6b37d685af8f381
SHA1d1dea4b4bbc183f0fadc0f7950c208729748efc7
SHA25612efe4a4d3e31ddc59bd3519d351f52081c34e5440840c995e9c7c1b233597a8
SHA51272401a0a682332a887e45939143368fa0588c12e22d365497b2ba83055405a7c13da756b1ff5725e3cd8f475640f95ef972448e78801caa39a5b143fe3ea5ead
-
Filesize
3.0MB
MD550b1f557ab4bfadde6b37d685af8f381
SHA1d1dea4b4bbc183f0fadc0f7950c208729748efc7
SHA25612efe4a4d3e31ddc59bd3519d351f52081c34e5440840c995e9c7c1b233597a8
SHA51272401a0a682332a887e45939143368fa0588c12e22d365497b2ba83055405a7c13da756b1ff5725e3cd8f475640f95ef972448e78801caa39a5b143fe3ea5ead
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
13.9MB
-
Filesize
13.9MB
-
Filesize
13.9MB
-
Filesize
13.9MB