Analysis
-
max time kernel
187s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 19:36
Static task
static1
Behavioral task
behavioral1
Sample
8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe
Resource
win10v2004-20221111-en
General
-
Target
8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe
-
Size
2.1MB
-
MD5
50eb36fd9bdf3697e177550ed2621e3e
-
SHA1
c63fe83cda2a808347693abd91a86011d030a372
-
SHA256
8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f
-
SHA512
1f2714d8d778d423f8a49807edaabf60f6b30d60ae7efaa3e6855a5a5db0a06911d45820bd754acfde5f26af0972c7a1b4349a41d1102cf4916eeb349ae5a357
-
SSDEEP
49152:OI7rilY9oyqvqu7M1f+Yj3US495gdpYMwhQ5N9Q/ZHH7AXEawXNHVHX9GHHM6uHY:pvilvlvh7odpSy/jwhG1
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
Processes:
8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exepid process 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exepid process 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exedescription pid process Token: SeDebugPrivilege 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe Token: SeDebugPrivilege 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exepid process 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe 1632 8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe"C:\Users\Admin\AppData\Local\Temp\8a5018b67b6164d532dc17046ae3029390a72671c378c98eadeb292d53efe00f.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1632-132-0x0000000000400000-0x0000000000763000-memory.dmpFilesize
3.4MB
-
memory/1632-133-0x0000000077330000-0x00000000774D3000-memory.dmpFilesize
1.6MB
-
memory/1632-134-0x0000000075210000-0x0000000075425000-memory.dmpFilesize
2.1MB
-
memory/1632-136-0x00000000762A0000-0x0000000076440000-memory.dmpFilesize
1.6MB
-
memory/1632-137-0x00000000755C0000-0x000000007563A000-memory.dmpFilesize
488KB
-
memory/1632-1481-0x0000000000400000-0x0000000000763000-memory.dmpFilesize
3.4MB
-
memory/1632-1482-0x0000000000400000-0x0000000000763000-memory.dmpFilesize
3.4MB
-
memory/1632-1483-0x0000000000400000-0x0000000000763000-memory.dmpFilesize
3.4MB
-
memory/1632-1484-0x0000000000400000-0x0000000000763000-memory.dmpFilesize
3.4MB
-
memory/1632-1486-0x0000000000400000-0x0000000000763000-memory.dmpFilesize
3.4MB
-
memory/1632-1487-0x0000000000400000-0x0000000000763000-memory.dmpFilesize
3.4MB
-
memory/1632-1488-0x0000000000400000-0x0000000000763000-memory.dmpFilesize
3.4MB