fb8cbdf6f88f40ae7d0baa1ae25408626a572dfb06a19ddad7a519be0ae7a759

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 15:53

Target

fb8cbdf6f88f40ae7d0baa1ae25408626a572dfb06a19ddad7a519be0ae7a759.exe
Size

181KB
MD5

4a1333a9ba74d9c0f4ad201e96ede7d7
SHA1

c7d19bb7325942d05857ae5fdc83a432bbc95222
SHA256

fb8cbdf6f88f40ae7d0baa1ae25408626a572dfb06a19ddad7a519be0ae7a759
SHA512

171964bd40441b70801eaba65b24a92bd42048f9d9f3ef5b0bb488d259250e7f7e24807d86a333026e714171f921c89720ff60b41dd1ca0b519e159508e68f0a
SSDEEP

3072:ZW9/Prtfh9XRu3tCGz0v25A4qs83uJ7vculwWYbDSHlegZoC+w0uMsi0q1jS7j7X:M9/PPu3wGzo25HqZU7UIwQHln/FMsipU

Score

7^/10

Unexpected DNS network traffic destination 2 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	83.133.123.20
Destination IP	83.133.123.20

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5060	fb8cbdf6f88f40ae7d0baa1ae25408626a572dfb06a19ddad7a519be0ae7a759.exe
5060	fb8cbdf6f88f40ae7d0baa1ae25408626a572dfb06a19ddad7a519be0ae7a759.exe
5060	fb8cbdf6f88f40ae7d0baa1ae25408626a572dfb06a19ddad7a519be0ae7a759.exe
5060	fb8cbdf6f88f40ae7d0baa1ae25408626a572dfb06a19ddad7a519be0ae7a759.exe
5060	fb8cbdf6f88f40ae7d0baa1ae25408626a572dfb06a19ddad7a519be0ae7a759.exe
5060	fb8cbdf6f88f40ae7d0baa1ae25408626a572dfb06a19ddad7a519be0ae7a759.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3092	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5060	fb8cbdf6f88f40ae7d0baa1ae25408626a572dfb06a19ddad7a519be0ae7a759.exe
Token: SeDebugPrivilege	5060	fb8cbdf6f88f40ae7d0baa1ae25408626a572dfb06a19ddad7a519be0ae7a759.exe
Token: SeDebugPrivilege	5060	fb8cbdf6f88f40ae7d0baa1ae25408626a572dfb06a19ddad7a519be0ae7a759.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 3092	5060	fb8cbdf6f88f40ae7d0baa1ae25408626a572dfb06a19ddad7a519be0ae7a759.exe	40

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3092
- C:\Users\Admin\AppData\Local\Temp\fb8cbdf6f88f40ae7d0baa1ae25408626a572dfb06a19ddad7a519be0ae7a759.exe
  "C:\Users\Admin\AppData\Local\Temp\fb8cbdf6f88f40ae7d0baa1ae25408626a572dfb06a19ddad7a519be0ae7a759.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5060

memory/5060-133-0x0000000000700000-0x0000000000733000-memory.dmp

Filesize
204KB

Download
memory/5060-132-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5060-134-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download