Analysis
-
max time kernel
151s -
max time network
87s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 20:33
Static task
static1
Behavioral task
behavioral1
Sample
c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe
Resource
win10v2004-20221111-en
General
-
Target
c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe
-
Size
2.2MB
-
MD5
df0090709dc4d4cfda6932ef72b7ab44
-
SHA1
0b566f877beddc94f4a7972797948e3fa27853e2
-
SHA256
c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533
-
SHA512
34a1f9fb2062f4fa99c97a8c5bd7a951206c337562f3a4ede8266d64634ef39f76a2853a4979295ef7a13061dd8c1eff811577bbe5b6aa6e368c9d09028a283f
-
SSDEEP
49152:em4aEm1f2oAR1HpLvpxCzWLiNFsU1bB97+8oOayKFQG9H:LZEMf2XRdx0hxF97+vOmWG9H
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1900-4869-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 53 IoCs
pid Process 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe 1900 c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe"C:\Users\Admin\AppData\Local\Temp\c4273e5f7618db908a01a4836b138b747ebcfccdb5aeadb439f87e0e82ec9533.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:1900