Analysis
-
max time kernel
90s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
16-02-2023 19:46
Behavioral task
behavioral1
Sample
8538bfa44565c1d81b3487cee9ea54e468130e3704922254d387c9919ffbfe76.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
8538bfa44565c1d81b3487cee9ea54e468130e3704922254d387c9919ffbfe76.exe
Resource
win10v2004-20221111-en
General
-
Target
8538bfa44565c1d81b3487cee9ea54e468130e3704922254d387c9919ffbfe76.exe
-
Size
1.2MB
-
MD5
49c34070396a4eb8ded1fa942dbcbf05
-
SHA1
80d766901ca88857d5d7494c567e57d8994f3bf7
-
SHA256
8538bfa44565c1d81b3487cee9ea54e468130e3704922254d387c9919ffbfe76
-
SHA512
53dc7c8f9ac4837f11885fe88d0934804a0cd028be7d8548ed72203e9bc49d76d3081a872991a8f5be5642fbf687ebdb78483722117b4095b9d14d780ca551fa
-
SSDEEP
24576:6zs2R3wI4Azj7HARBCZKr7GxVX/ZwZpKhS/Gu6UKCOcL0wayR5:6zsYz4AX7gRBWWqxVX/aX//GjU4Y
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1328-136-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1328-138-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1328-139-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1328-143-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1328-141-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1328-145-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1328-140-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1328-147-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1328-149-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1328-151-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1328-153-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1328-155-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1328-157-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1328-159-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1328-161-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1328-163-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1328-165-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1328-167-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1328-169-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1328-171-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1328-173-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1328-175-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1328-177-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1328-179-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1328-181-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1328-182-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
8538bfa44565c1d81b3487cee9ea54e468130e3704922254d387c9919ffbfe76.exedescription pid process Token: SeDebugPrivilege 1328 8538bfa44565c1d81b3487cee9ea54e468130e3704922254d387c9919ffbfe76.exe Token: SeDebugPrivilege 1328 8538bfa44565c1d81b3487cee9ea54e468130e3704922254d387c9919ffbfe76.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
8538bfa44565c1d81b3487cee9ea54e468130e3704922254d387c9919ffbfe76.exepid process 1328 8538bfa44565c1d81b3487cee9ea54e468130e3704922254d387c9919ffbfe76.exe 1328 8538bfa44565c1d81b3487cee9ea54e468130e3704922254d387c9919ffbfe76.exe 1328 8538bfa44565c1d81b3487cee9ea54e468130e3704922254d387c9919ffbfe76.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8538bfa44565c1d81b3487cee9ea54e468130e3704922254d387c9919ffbfe76.exe"C:\Users\Admin\AppData\Local\Temp\8538bfa44565c1d81b3487cee9ea54e468130e3704922254d387c9919ffbfe76.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1328-132-0x0000000000400000-0x00000000007DD000-memory.dmpFilesize
3.9MB
-
memory/1328-133-0x0000000000400000-0x00000000007DD000-memory.dmpFilesize
3.9MB
-
memory/1328-135-0x0000000000400000-0x00000000007DD000-memory.dmpFilesize
3.9MB
-
memory/1328-136-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1328-138-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1328-139-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1328-143-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1328-141-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1328-145-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1328-140-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1328-147-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1328-149-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1328-151-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1328-153-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1328-155-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1328-157-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1328-159-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1328-161-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1328-163-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1328-165-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1328-167-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1328-169-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1328-171-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1328-173-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1328-175-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1328-177-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1328-179-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1328-181-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1328-182-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1328-183-0x0000000000400000-0x00000000007DD000-memory.dmpFilesize
3.9MB