Analysis
-
max time kernel
169s -
max time network
178s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 19:26
Static task
static1
Behavioral task
behavioral1
Sample
068a8110afd95f46101344289c1ce64c91230f8c637db7deab157cb78d706238.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
068a8110afd95f46101344289c1ce64c91230f8c637db7deab157cb78d706238.exe
Resource
win10v2004-20220812-en
General
-
Target
068a8110afd95f46101344289c1ce64c91230f8c637db7deab157cb78d706238.exe
-
Size
469KB
-
MD5
c28782072861b31636b87916d4463e7c
-
SHA1
bd9537285363062dd67e7d6213bbba1b887efe41
-
SHA256
068a8110afd95f46101344289c1ce64c91230f8c637db7deab157cb78d706238
-
SHA512
eabbf70d6a3bfa3fdc6b525f5144c5c2affe435c207ce463e0fb7a121ec22e8e06100ab0a70ef73645c480d3a891b776149324bb363007dbefe508686021c29d
-
SSDEEP
12288:nQduZgCDOfyZBnC+QRWNHsQGF0pcsMTXgQmz9eNLqjd5:zZgCD9C+EWNML2pcsM7YReojL
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
zmkkghwlhsdjiuf.exepid process 1752 zmkkghwlhsdjiuf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
zmkkghwlhsdjiuf.exedescription pid process Token: SeDebugPrivilege 1752 zmkkghwlhsdjiuf.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
zmkkghwlhsdjiuf.exepid process 1752 zmkkghwlhsdjiuf.exe 1752 zmkkghwlhsdjiuf.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
068a8110afd95f46101344289c1ce64c91230f8c637db7deab157cb78d706238.exedescription pid process target process PID 3612 wrote to memory of 1752 3612 068a8110afd95f46101344289c1ce64c91230f8c637db7deab157cb78d706238.exe zmkkghwlhsdjiuf.exe PID 3612 wrote to memory of 1752 3612 068a8110afd95f46101344289c1ce64c91230f8c637db7deab157cb78d706238.exe zmkkghwlhsdjiuf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\068a8110afd95f46101344289c1ce64c91230f8c637db7deab157cb78d706238.exe"C:\Users\Admin\AppData\Local\Temp\068a8110afd95f46101344289c1ce64c91230f8c637db7deab157cb78d706238.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\zmkkghwlhsdjiuf.exe"C:\Users\Admin\AppData\Local\Temp\\zmkkghwlhsdjiuf.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1752
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\parent.txtFilesize
469KB
MD5c28782072861b31636b87916d4463e7c
SHA1bd9537285363062dd67e7d6213bbba1b887efe41
SHA256068a8110afd95f46101344289c1ce64c91230f8c637db7deab157cb78d706238
SHA512eabbf70d6a3bfa3fdc6b525f5144c5c2affe435c207ce463e0fb7a121ec22e8e06100ab0a70ef73645c480d3a891b776149324bb363007dbefe508686021c29d
-
C:\Users\Admin\AppData\Local\Temp\zmkkghwlhsdjiuf.exeFilesize
18KB
MD5080496d64c7b605530efb40a7bbf9259
SHA18e27dcdf5b271c295987c908dfb6ba4d4ab376c4
SHA256acfc068fcfa5ec65bd8a3e235ada2c6ee86dca3d1d1f866a40c20ad5948a4f87
SHA512ddc7c2c18e34f27517357584903323f36368736e4c50e342546666dbc369475691834de8ad4028104585199dbb531482ae72ebd9e7235fff46a7c9716bd11402
-
C:\Users\Admin\AppData\Local\Temp\zmkkghwlhsdjiuf.exeFilesize
18KB
MD5080496d64c7b605530efb40a7bbf9259
SHA18e27dcdf5b271c295987c908dfb6ba4d4ab376c4
SHA256acfc068fcfa5ec65bd8a3e235ada2c6ee86dca3d1d1f866a40c20ad5948a4f87
SHA512ddc7c2c18e34f27517357584903323f36368736e4c50e342546666dbc369475691834de8ad4028104585199dbb531482ae72ebd9e7235fff46a7c9716bd11402
-
memory/1752-132-0x0000000000000000-mapping.dmp
-
memory/1752-135-0x00007FF8F22E0000-0x00007FF8F2D16000-memory.dmpFilesize
10.2MB
-
memory/1752-137-0x0000000000800000-0x0000000000810000-memory.dmpFilesize
64KB
-
memory/1752-138-0x0000000000800000-0x0000000000810000-memory.dmpFilesize
64KB