Analysis
-
max time kernel
41s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 15:23
Static task
static1
Behavioral task
behavioral1
Sample
2b350c0556f66fec534c29fbd2b23c6dd2c77c6e57b71c2c4dd0907ce872d013.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2b350c0556f66fec534c29fbd2b23c6dd2c77c6e57b71c2c4dd0907ce872d013.exe
Resource
win10v2004-20220812-en
General
-
Target
2b350c0556f66fec534c29fbd2b23c6dd2c77c6e57b71c2c4dd0907ce872d013.exe
-
Size
148KB
-
MD5
2ffd1b88b06c71d54e978fc574410f4c
-
SHA1
271aa395e49079b3e04d264ec2028d0c6e5e8752
-
SHA256
2b350c0556f66fec534c29fbd2b23c6dd2c77c6e57b71c2c4dd0907ce872d013
-
SHA512
7419318a672118e145e57024b3a3a48bad29654c3ed87e8a39ee168c38361e5f89c2791b950288413eb18fe93a57f095e0d758dc15be4b38c65b8cef90edef5f
-
SSDEEP
1536:tdHdwck6vZ2rT1eCi9RDrLJHG0TNltvcWf4et0p+e85tVkh9oRybNsu2DKF:terBO9hjTNjc04l+TthRVW
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1612 2b350c0556f66fec534c29fbd2b23c6dd2c77c6e57b71c2c4dd0907ce872d013.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1612 2b350c0556f66fec534c29fbd2b23c6dd2c77c6e57b71c2c4dd0907ce872d013.exe 1612 2b350c0556f66fec534c29fbd2b23c6dd2c77c6e57b71c2c4dd0907ce872d013.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b350c0556f66fec534c29fbd2b23c6dd2c77c6e57b71c2c4dd0907ce872d013.exe"C:\Users\Admin\AppData\Local\Temp\2b350c0556f66fec534c29fbd2b23c6dd2c77c6e57b71c2c4dd0907ce872d013.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: MapViewOfSection
PID:1612