Analysis
-
max time kernel
41s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 14:12
Static task
static1
Behavioral task
behavioral1
Sample
2aacc2e318580a637ad4080cfe69128aa48e03493b7cb24a3ffda8f1f48b5394.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2aacc2e318580a637ad4080cfe69128aa48e03493b7cb24a3ffda8f1f48b5394.exe
Resource
win10v2004-20220812-en
General
-
Target
2aacc2e318580a637ad4080cfe69128aa48e03493b7cb24a3ffda8f1f48b5394.exe
-
Size
102KB
-
MD5
60bfe2ffbca55a63912fd46f91ae8a42
-
SHA1
c8cca39f58566c7fcc05aa841dcdf989ba46059b
-
SHA256
2aacc2e318580a637ad4080cfe69128aa48e03493b7cb24a3ffda8f1f48b5394
-
SHA512
8359953c7e9618b63c5ddb898de3fc4dd1e04225b6dcddc7f4b484d1b1d569b3901b24ed6257dbc01819f506a82df6063379ab1858eb7472573589d4fcec9254
-
SSDEEP
1536:daM34GvOvJT4AQM4rgFVizYBsxm4+ooY6wMznNpu/XuiZd3Y7RFJMHHJ2MbJS:ga4GvOcgSzpxm4+ooMM+XRASpF
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1112 2aacc2e318580a637ad4080cfe69128aa48e03493b7cb24a3ffda8f1f48b5394.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1112 2aacc2e318580a637ad4080cfe69128aa48e03493b7cb24a3ffda8f1f48b5394.exe 1112 2aacc2e318580a637ad4080cfe69128aa48e03493b7cb24a3ffda8f1f48b5394.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2aacc2e318580a637ad4080cfe69128aa48e03493b7cb24a3ffda8f1f48b5394.exe"C:\Users\Admin\AppData\Local\Temp\2aacc2e318580a637ad4080cfe69128aa48e03493b7cb24a3ffda8f1f48b5394.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: MapViewOfSection
PID:1112