Analysis
-
max time kernel
177s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 18:26
Behavioral task
behavioral1
Sample
9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe
Resource
win10v2004-20221111-en
General
-
Target
9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe
-
Size
472KB
-
MD5
d4f717d1a7633585f442d3993ce032e2
-
SHA1
23807eb8803230442b034dea2e27a2f7bfae29c2
-
SHA256
9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316
-
SHA512
134a3857da52c72a52a143e4527d5257f8dfe17a6c669d9543e614c731069889f64461687aacef12ef2ba98564b574e17bf7b3190461413545e8baf51d1defee
-
SSDEEP
6144:zLBZEPZPdY1SlviF2lb54HSRpSndxHkw1+IIzep16K1hE2JWy7t3GPw:zLBZEPZP21SlKAlb54HKpA7jLh17cP
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4084-132-0x0000000000400000-0x000000000056B000-memory.dmp vmprotect behavioral2/memory/4084-133-0x0000000000400000-0x000000000056B000-memory.dmp vmprotect behavioral2/memory/4084-135-0x0000000000400000-0x000000000056B000-memory.dmp vmprotect -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exepid process 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
pid process 660 660 -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exepid process 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe 4084 9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe"C:\Users\Admin\AppData\Local\Temp\9205a255ea8ad8f6c41eca215e42ac659462ea87ffdcfaf95c67e868c9392316.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx