Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 06:29
Static task
static1
Behavioral task
behavioral1
Sample
c50e149bfc7dd14b5fbab251912d14fcf83c9063426254819ae790e6a2e57317.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c50e149bfc7dd14b5fbab251912d14fcf83c9063426254819ae790e6a2e57317.exe
Resource
win10v2004-20220812-en
General
-
Target
c50e149bfc7dd14b5fbab251912d14fcf83c9063426254819ae790e6a2e57317.exe
-
Size
404KB
-
MD5
eba20892c5248852547ceb71c0b8194f
-
SHA1
856f9fce74a49666a2822404020e33ee0f8ac283
-
SHA256
c50e149bfc7dd14b5fbab251912d14fcf83c9063426254819ae790e6a2e57317
-
SHA512
c8e23f83d19b5ea14698ab5a4d14cf725a131c8530e2023902623b88d4f1d0fb61e0746c9265707dc9752f2ae407154993beb2ec0fdaf7159baae1525fdda3a6
-
SSDEEP
12288:IeOKS7QZot/YmfgZsOlo3hsdR0QIABfv2LuE75rEvc:IvKSsZO/YmksOlo3hsdCQIABfuLuE7O
Malware Config
Signatures
-
NTFS ADS 3 IoCs
description ioc Process File created C:\ProgramData:$SS_DESCRIPTOR_XBXCVBBKLVV4V6NYG7LY8KPJEKT119LTCVKRBHD c50e149bfc7dd14b5fbab251912d14fcf83c9063426254819ae790e6a2e57317.exe File created C:\ProgramData\dsadasds\4.2.2.5.4.3:$SS_DESCRIPTOR_XBXCVBBKLVV4V6NYG7LY8KPJEKT119LTCVKRBHD c50e149bfc7dd14b5fbab251912d14fcf83c9063426254819ae790e6a2e57317.exe File created C:\Users\Public\Desktop:$SS_DESCRIPTOR_XBXCVBBKLVV4V6NYG7LY8KPJEKT119LTCVKRBHD c50e149bfc7dd14b5fbab251912d14fcf83c9063426254819ae790e6a2e57317.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2220 c50e149bfc7dd14b5fbab251912d14fcf83c9063426254819ae790e6a2e57317.exe 2220 c50e149bfc7dd14b5fbab251912d14fcf83c9063426254819ae790e6a2e57317.exe 2220 c50e149bfc7dd14b5fbab251912d14fcf83c9063426254819ae790e6a2e57317.exe 2220 c50e149bfc7dd14b5fbab251912d14fcf83c9063426254819ae790e6a2e57317.exe 2220 c50e149bfc7dd14b5fbab251912d14fcf83c9063426254819ae790e6a2e57317.exe 2220 c50e149bfc7dd14b5fbab251912d14fcf83c9063426254819ae790e6a2e57317.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2220 c50e149bfc7dd14b5fbab251912d14fcf83c9063426254819ae790e6a2e57317.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c50e149bfc7dd14b5fbab251912d14fcf83c9063426254819ae790e6a2e57317.exe"C:\Users\Admin\AppData\Local\Temp\c50e149bfc7dd14b5fbab251912d14fcf83c9063426254819ae790e6a2e57317.exe"1⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2220