Analysis
-
max time kernel
208s -
max time network
210s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 05:23
Behavioral task
behavioral1
Sample
acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe
Resource
win10v2004-20221111-en
General
-
Target
acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe
-
Size
988KB
-
MD5
2eed3a0e4c9c11c708cee31112d047aa
-
SHA1
4b809cfc6eacfb52931494c0ef5e94e4f86cb395
-
SHA256
acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72
-
SHA512
05fcf13db0c9dddc611104f6eb9a84601ffdeaf94d12c6576427ae16c5727816dc6eada2eb20b7394bb55548b61f972c4e6f86e9b6e563efc9d6b9408bd504e2
-
SSDEEP
24576:GL7nPDCVHS5MGaKqjBskO8amG01Q0fFQidm:GLLuAFaK2y/aG01Q0mt
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/2248-132-0x0000000000400000-0x0000000000636000-memory.dmp vmprotect behavioral2/memory/2248-133-0x0000000000400000-0x0000000000636000-memory.dmp vmprotect behavioral2/memory/2248-137-0x0000000000400000-0x0000000000636000-memory.dmp vmprotect -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exepid process 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exepid process 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exepid process 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe 2248 acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe"C:\Users\Admin\AppData\Local\Temp\acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx