Analysis
-
max time kernel
150s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 06:19
Behavioral task
behavioral1
Sample
蚂蚁大叔免费账号共享器w.05 .exe
Resource
win7-20221111-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
蚂蚁大叔免费账号共享器w.05 .exe
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
蚂蚁大叔免费账号共享器w.05 .exe
-
Size
1.4MB
-
MD5
04465c4fb49d06f649cd0973c55c047e
-
SHA1
d2b9ba5c0af9eeb684240d7ed8b5e6cba19fd1a0
-
SHA256
1307236c161f13d553ee7f966f3b62c1ccdb818cc25ccaf511e2af7262be179b
-
SHA512
d0531a2ee353bf34f3438722f97d16a6c97ffcb9856ef9b2aac4d54cda43de231764d2e76655f1d2cbbf5aeb23167fdebd3089901c09a1a84a80c66700c1bf2f
-
SSDEEP
24576:9HZa8tmIbJMpjISWPooCdbB4SqJ0eOqQc/1g++Sf3Jx7QCKzWqFrKPmQ:TAISWPO/qPQcSSf5xkblpGm
Score
8/10
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1416-132-0x0000000000400000-0x0000000000717000-memory.dmp vmprotect behavioral2/memory/1416-133-0x0000000000400000-0x0000000000717000-memory.dmp vmprotect behavioral2/memory/1416-135-0x0000000000400000-0x0000000000717000-memory.dmp vmprotect -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
蚂蚁大叔免费账号共享器w.05 .exepid process 1416 蚂蚁大叔免费账号共享器w.05 .exe 1416 蚂蚁大叔免费账号共享器w.05 .exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
蚂蚁大叔免费账号共享器w.05 .exepid process 1416 蚂蚁大叔免费账号共享器w.05 .exe 1416 蚂蚁大叔免费账号共享器w.05 .exe 1416 蚂蚁大叔免费账号共享器w.05 .exe 1416 蚂蚁大叔免费账号共享器w.05 .exe