ae42002642b66749e3c90d87ceefef90d9b779264098a382f9beca8fa3e51e1c

Analysis

max time kernel
271s
max time network
298s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 05:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae42002642b66749e3c90d87ceefef90d9b779264098a382f9beca8fa3e51e1c.exe
Size

193KB
MD5

f442030f5eddb3d904b1767ddd739f60
SHA1

721d14089ac54354fc8153f254ca73fdbf769bda
SHA256

ae42002642b66749e3c90d87ceefef90d9b779264098a382f9beca8fa3e51e1c
SHA512

1c800eef93c7cd4017b138a11e312e460f98bf63f818c84601138aac10c4ee50c74b4839383fd11fbae66f009e866c4af661097f247a315c1c758e203c36ffbf
SSDEEP

6144:go3QGUO4lALlcurLcjJP4bnmblo7ZV28RyXZOYUovVJ:vQXlAxcu0J/blot98ZOJc

Score

7^/10

Malware Config

Signatures

Unexpected DNS network traffic destination 2 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	83.133.123.20
Destination IP	83.133.123.20

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1940 set thread context of 4564	1940	ae42002642b66749e3c90d87ceefef90d9b779264098a382f9beca8fa3e51e1c.exe	81

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1940	ae42002642b66749e3c90d87ceefef90d9b779264098a382f9beca8fa3e51e1c.exe
1940	ae42002642b66749e3c90d87ceefef90d9b779264098a382f9beca8fa3e51e1c.exe
1940	ae42002642b66749e3c90d87ceefef90d9b779264098a382f9beca8fa3e51e1c.exe
1940	ae42002642b66749e3c90d87ceefef90d9b779264098a382f9beca8fa3e51e1c.exe
1940	ae42002642b66749e3c90d87ceefef90d9b779264098a382f9beca8fa3e51e1c.exe
1940	ae42002642b66749e3c90d87ceefef90d9b779264098a382f9beca8fa3e51e1c.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2572	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	1940	ae42002642b66749e3c90d87ceefef90d9b779264098a382f9beca8fa3e51e1c.exe
Token: SeDebugPrivilege	1940	ae42002642b66749e3c90d87ceefef90d9b779264098a382f9beca8fa3e51e1c.exe
Token: SeDebugPrivilege	1940	ae42002642b66749e3c90d87ceefef90d9b779264098a382f9beca8fa3e51e1c.exe
Token: SeShutdownPrivilege	2572	Explorer.EXE
Token: SeCreatePagefilePrivilege	2572	Explorer.EXE
Token: SeShutdownPrivilege	2572	Explorer.EXE
Token: SeCreatePagefilePrivilege	2572	Explorer.EXE
Token: SeShutdownPrivilege	2572	Explorer.EXE
Token: SeCreatePagefilePrivilege	2572	Explorer.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2572	1940	ae42002642b66749e3c90d87ceefef90d9b779264098a382f9beca8fa3e51e1c.exe	44
PID 1940 wrote to memory of 4564	1940	ae42002642b66749e3c90d87ceefef90d9b779264098a382f9beca8fa3e51e1c.exe	81
PID 1940 wrote to memory of 4564	1940	ae42002642b66749e3c90d87ceefef90d9b779264098a382f9beca8fa3e51e1c.exe	81
PID 1940 wrote to memory of 4564	1940	ae42002642b66749e3c90d87ceefef90d9b779264098a382f9beca8fa3e51e1c.exe	81
PID 1940 wrote to memory of 4564	1940	ae42002642b66749e3c90d87ceefef90d9b779264098a382f9beca8fa3e51e1c.exe	81

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2572
- C:\Users\Admin\AppData\Local\Temp\ae42002642b66749e3c90d87ceefef90d9b779264098a382f9beca8fa3e51e1c.exe
  "C:\Users\Admin\AppData\Local\Temp\ae42002642b66749e3c90d87ceefef90d9b779264098a382f9beca8fa3e51e1c.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:4564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1940-145-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1940-133-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1940-134-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1940-135-0x00000000006F0000-0x0000000000724000-memory.dmp

Filesize
208KB

Download
memory/1940-136-0x00000000006F0000-0x0000000000724000-memory.dmp

Filesize
208KB

Download
memory/1940-137-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1940-138-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1940-146-0x00000000006F0000-0x0000000000724000-memory.dmp

Filesize
208KB

Download
memory/1940-132-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2572-140-0x0000000002370000-0x0000000002380000-memory.dmp

Filesize
64KB

Download
memory/2572-142-0x0000000002370000-0x0000000002380000-memory.dmp

Filesize
64KB

Download
memory/2572-143-0x0000000000AB0000-0x0000000000AC0000-memory.dmp

Filesize
64KB

Download
memory/2572-144-0x0000000000AB0000-0x0000000000AC0000-memory.dmp

Filesize
64KB

Download
memory/2572-141-0x0000000000AB0000-0x0000000000AC0000-memory.dmp

Filesize
64KB

Download
memory/2572-147-0x0000000000AB0000-0x0000000000AC0000-memory.dmp

Filesize
64KB

Download
memory/2572-148-0x0000000000AB0000-0x0000000000AC0000-memory.dmp

Filesize
64KB

Download
memory/4564-139-0x0000000000000000-mapping.dmp

Download