Analysis

  • max time kernel
    34s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    28/11/2022, 01:47

General

  • Target

    c2ab6e83c65e4d373c1f186aa597da070d03d3d8ea19e1cb0f52f1dd896ea153.exe

  • Size

    61KB

  • MD5

    dc00ebd8cbf9ab0da4e8a6eeda694035

  • SHA1

    de45cdebcbe339b033a86da7b788d482e5842c63

  • SHA256

    c2ab6e83c65e4d373c1f186aa597da070d03d3d8ea19e1cb0f52f1dd896ea153

  • SHA512

    0f1e29aa96e6e34f7300002b0d364bc504773091555bd9106aa93c9e3dd48d30601986e3eaec9efd5476364d35e7577955dff431ac42b4a3edd45fa7527f0f56

  • SSDEEP

    768:umfCR7nHJSXgPRbrP1/53bR8nrHJS8Rl3MMYEo7jzUw8H1ZDwXAan:uMCRnHAu31/Vt8nrjRl3dYEmUw8Vw

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c2ab6e83c65e4d373c1f186aa597da070d03d3d8ea19e1cb0f52f1dd896ea153.exe
    "C:\Users\Admin\AppData\Local\Temp\c2ab6e83c65e4d373c1f186aa597da070d03d3d8ea19e1cb0f52f1dd896ea153.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: MapViewOfSection
    PID:1920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1256-58-0x0000000077970000-0x0000000077B19000-memory.dmp

    Filesize

    1.7MB

  • memory/1920-55-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/1920-54-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/1920-56-0x0000000000220000-0x0000000000239000-memory.dmp

    Filesize

    100KB

  • memory/1920-57-0x0000000000220000-0x0000000000239000-memory.dmp

    Filesize

    100KB