Analysis
-
max time kernel
123s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05-12-2022 11:40
Static task
static1
Behavioral task
behavioral1
Sample
987d1c097c63ae5a477fabdc42b2025aa5ec504bc33874d2ef815744c306c558.exe
Resource
win7-20220901-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
987d1c097c63ae5a477fabdc42b2025aa5ec504bc33874d2ef815744c306c558.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
987d1c097c63ae5a477fabdc42b2025aa5ec504bc33874d2ef815744c306c558.exe
-
Size
108KB
-
MD5
9cd49d5fbf7ab3adc2d3ea645e2ff701
-
SHA1
814a990be6008433b5be1695c25cc6cce831898d
-
SHA256
987d1c097c63ae5a477fabdc42b2025aa5ec504bc33874d2ef815744c306c558
-
SHA512
4ba30373683f1b56804e08f06d58bc1d5374b6d7168bd0890053e65ac39a911279eec06a05fd30b1039ab835507251c05e3158a78cb244d063a8e4b33acd8baa
-
SSDEEP
3072:VD4e90IQt8IF1HVpsWbYYb8SyAVKsN/9r4:FQt8q1pYaycN/9r
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ntxeed.dll 987d1c097c63ae5a477fabdc42b2025aa5ec504bc33874d2ef815744c306c558.exe File opened for modification C:\Windows\SysWOW64\amurpm.dll 987d1c097c63ae5a477fabdc42b2025aa5ec504bc33874d2ef815744c306c558.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5052 987d1c097c63ae5a477fabdc42b2025aa5ec504bc33874d2ef815744c306c558.exe 5052 987d1c097c63ae5a477fabdc42b2025aa5ec504bc33874d2ef815744c306c558.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5052 987d1c097c63ae5a477fabdc42b2025aa5ec504bc33874d2ef815744c306c558.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5052 987d1c097c63ae5a477fabdc42b2025aa5ec504bc33874d2ef815744c306c558.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\987d1c097c63ae5a477fabdc42b2025aa5ec504bc33874d2ef815744c306c558.exe"C:\Users\Admin\AppData\Local\Temp\987d1c097c63ae5a477fabdc42b2025aa5ec504bc33874d2ef815744c306c558.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5052