883ed64083968eec69d6974ce6f58e5cce6d84319a71a439edcb4f0a06283b97 | Triage

Resubmissions

28-02-2023 04:33

230228-e6jwtahe77 10

28-02-2023 04:28

230228-e3nqlahe69 10

Analysis

max time kernel
14s
max time network
18s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
28-02-2023 04:33

Sharing

Report Analysis Logs

General

Target

Plugins/Keylogger.exe
Size

10KB
MD5

4f846f2117c4eab285289b0090521b1e
SHA1

e25287c39bad32159417c5f0bf798625b6beff45
SHA256

a17a5bf35d8b784c3111632ba7e0c30a2c1a9c2c95b549235affc16d6d055477
SHA512

fd946b5f7c3c7d32f226897283de7ba3b4a4ecc2919c363877f1258cd24ed1a52bce53af2fe4ef34c4ac30d00fc456fd4e1593b79c37f7c22211f2c4f6092e5e
SSDEEP

192:irtmcuq65SoDxi4maEYbRzmEsLkjgv5JHT1eJYHcwY7fazB+LEi:irtlF60GE9rUhVsLF5p1rYydmE

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Keylogger.exe

pid process

4144 Keylogger.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Keylogger.exe

description pid process

Token: SeDebugPrivilege 4144 Keylogger.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Keylogger.exe

pid process

4144 Keylogger.exe

C:\Users\Admin\AppData\Local\Temp\Plugins\Keylogger.exe
"C:\Users\Admin\AppData\Local\Temp\Plugins\Keylogger.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4144-116-0x0000000000F30000-0x0000000000F38000-memory.dmp

Filesize
32KB

Download
memory/4144-117-0x000000001BB10000-0x000000001BB20000-memory.dmp

Filesize
64KB

Download
memory/4144-118-0x000000001BB10000-0x000000001BB20000-memory.dmp

Filesize
64KB

Download