Analysis
-
max time kernel
96s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 07:29
Behavioral task
behavioral1
Sample
788d2fe0eec70ae6770a68fae40296d02e9631319c75bf1358f18a6f481f8fc0.exe
Resource
win7-20220901-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
788d2fe0eec70ae6770a68fae40296d02e9631319c75bf1358f18a6f481f8fc0.exe
Resource
win10v2004-20220812-en
4 signatures
150 seconds
General
-
Target
788d2fe0eec70ae6770a68fae40296d02e9631319c75bf1358f18a6f481f8fc0.exe
-
Size
708KB
-
MD5
bec94e18348cdb40f555feff44b25a03
-
SHA1
6df6773eac30d38bd52097da05998ad37ec8d7ba
-
SHA256
788d2fe0eec70ae6770a68fae40296d02e9631319c75bf1358f18a6f481f8fc0
-
SHA512
5bfa49530f920542cd28a428a369a99871ac5eb6bef53066ed4f98d9187aca8bede3815661356787d2bd2685c6d216e6ea60cb7aff9dad901781d555d3bed0f8
-
SSDEEP
12288:9+HHlzXHkOFjfssMjd1LnaCFyEZrQzDBq+j8YaZ6:9k0OBsHd1PFyEZrQzDD8DZ6
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4492-132-0x0000000000400000-0x0000000000600000-memory.dmp vmprotect behavioral2/memory/4492-133-0x0000000000400000-0x0000000000600000-memory.dmp vmprotect behavioral2/memory/4492-136-0x0000000000400000-0x0000000000600000-memory.dmp vmprotect behavioral2/memory/4492-137-0x0000000000400000-0x0000000000600000-memory.dmp vmprotect behavioral2/memory/4492-138-0x0000000000400000-0x0000000000600000-memory.dmp vmprotect -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4492 788d2fe0eec70ae6770a68fae40296d02e9631319c75bf1358f18a6f481f8fc0.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4492 788d2fe0eec70ae6770a68fae40296d02e9631319c75bf1358f18a6f481f8fc0.exe 4492 788d2fe0eec70ae6770a68fae40296d02e9631319c75bf1358f18a6f481f8fc0.exe 4492 788d2fe0eec70ae6770a68fae40296d02e9631319c75bf1358f18a6f481f8fc0.exe 4492 788d2fe0eec70ae6770a68fae40296d02e9631319c75bf1358f18a6f481f8fc0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\788d2fe0eec70ae6770a68fae40296d02e9631319c75bf1358f18a6f481f8fc0.exe"C:\Users\Admin\AppData\Local\Temp\788d2fe0eec70ae6770a68fae40296d02e9631319c75bf1358f18a6f481f8fc0.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:4492