25f5625ca29d97a097fcf2a3750c20df4b71c00e745b2b0905060e3be36ad77a

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2023 16:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25f5625ca29d97a097fcf2a3750c20df4b71c00e745b2b0905060e3be36ad77a.exe
Size

1.6MB
MD5

0e1b2b53ca02872f52ae1c9b19c064e3
SHA1

1ef365bfbc36976de14965ecdf8a2db159de6ed4
SHA256

25f5625ca29d97a097fcf2a3750c20df4b71c00e745b2b0905060e3be36ad77a
SHA512

6bb6010d8a81cc77b30343ebda705fc55b81a5a76a9bc07a3cd2417f2c3e4772b9875813bd447b43de570e50b259e01a253073ee1b332c9c314751536a5de9c1
SSDEEP

49152:7p2Xk24Lko9TQprjvnp2rObS7oP00tcu3WIxJHjiaJ75TL0jljMnAVQcW:dG4LkQT8rjvQqu7a0Ucu5xJHjiY5nQln

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
45.151.135.235
Port:
21
Username:
123
Password:
123

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

25f5625ca29d97a097fcf2a3750c20df4b71c00e745b2b0905060e3be36ad77a.exe

pid	process
2312	25f5625ca29d97a097fcf2a3750c20df4b71c00e745b2b0905060e3be36ad77a.exe
2312	25f5625ca29d97a097fcf2a3750c20df4b71c00e745b2b0905060e3be36ad77a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

25f5625ca29d97a097fcf2a3750c20df4b71c00e745b2b0905060e3be36ad77a.exe

description pid process

Token: SeDebugPrivilege 2312 25f5625ca29d97a097fcf2a3750c20df4b71c00e745b2b0905060e3be36ad77a.exe

description	pid	process
Token: SeDebugPrivilege	2312	25f5625ca29d97a097fcf2a3750c20df4b71c00e745b2b0905060e3be36ad77a.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

25f5625ca29d97a097fcf2a3750c20df4b71c00e745b2b0905060e3be36ad77a.exe25f5625ca29d97a097fcf2a3750c20df4b71c00e745b2b0905060e3be36ad77a.exe25f5625ca29d97a097fcf2a3750c20df4b71c00e745b2b0905060e3be36ad77a.exe

pid	process
2312	25f5625ca29d97a097fcf2a3750c20df4b71c00e745b2b0905060e3be36ad77a.exe
3788	25f5625ca29d97a097fcf2a3750c20df4b71c00e745b2b0905060e3be36ad77a.exe
4928	25f5625ca29d97a097fcf2a3750c20df4b71c00e745b2b0905060e3be36ad77a.exe

C:\Users\Admin\AppData\Local\Temp\25f5625ca29d97a097fcf2a3750c20df4b71c00e745b2b0905060e3be36ad77a.exe
"C:\Users\Admin\AppData\Local\Temp\25f5625ca29d97a097fcf2a3750c20df4b71c00e745b2b0905060e3be36ad77a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2312

C:\Users\Admin\AppData\Local\Temp\25f5625ca29d97a097fcf2a3750c20df4b71c00e745b2b0905060e3be36ad77a.exe
C:\Users\Admin\AppData\Local\Temp\25f5625ca29d97a097fcf2a3750c20df4b71c00e745b2b0905060e3be36ad77a.exe
1⤵
- Suspicious use of SetWindowsHookEx
PID:3788

C:\Users\Admin\AppData\Local\Temp\25f5625ca29d97a097fcf2a3750c20df4b71c00e745b2b0905060e3be36ad77a.exe
C:\Users\Admin\AppData\Local\Temp\25f5625ca29d97a097fcf2a3750c20df4b71c00e745b2b0905060e3be36ad77a.exe
1⤵
- Suspicious use of SetWindowsHookEx
PID:4928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\25f5625ca29d97a097fcf2a3750c20df4b71c00e745b2b0905060e3be36ad77a.exe.log

Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
memory/2312-147-0x00000000074B0000-0x0000000007526000-memory.dmp

Filesize
472KB

Download
memory/2312-136-0x0000000005D40000-0x0000000005D50000-memory.dmp

Filesize
64KB

Download
memory/2312-139-0x0000000006330000-0x00000000063CC000-memory.dmp

Filesize
624KB

Download
memory/2312-140-0x0000000006980000-0x0000000006F24000-memory.dmp

Filesize
5.6MB

Download
memory/2312-141-0x00000000063D0000-0x0000000006436000-memory.dmp

Filesize
408KB

Download
memory/2312-143-0x0000000005D40000-0x0000000005D50000-memory.dmp

Filesize
64KB

Download
memory/2312-144-0x0000000005D40000-0x0000000005D50000-memory.dmp

Filesize
64KB

Download
memory/2312-148-0x0000000007530000-0x000000000754E000-memory.dmp

Filesize
120KB

Download
memory/2312-146-0x0000000005D40000-0x0000000005D50000-memory.dmp

Filesize
64KB

Download
memory/2312-135-0x0000000005D40000-0x0000000005D50000-memory.dmp

Filesize
64KB

Download
memory/2312-145-0x0000000005D40000-0x0000000005D50000-memory.dmp

Filesize
64KB

Download
memory/2312-137-0x0000000005D40000-0x0000000005D50000-memory.dmp

Filesize
64KB

Download
memory/3788-153-0x0000000006440000-0x0000000006450000-memory.dmp

Filesize
64KB

Download
memory/3788-152-0x0000000006440000-0x0000000006450000-memory.dmp

Filesize
64KB

Download
memory/3788-154-0x0000000006440000-0x0000000006450000-memory.dmp

Filesize
64KB

Download
memory/3788-151-0x0000000006440000-0x0000000006450000-memory.dmp

Filesize
64KB

Download
memory/4928-159-0x00000000060F0000-0x0000000006100000-memory.dmp

Filesize
64KB

Download
memory/4928-160-0x00000000060F0000-0x0000000006100000-memory.dmp

Filesize
64KB

Download
memory/4928-161-0x00000000060F0000-0x0000000006100000-memory.dmp

Filesize
64KB

Download
memory/4928-162-0x00000000060F0000-0x0000000006100000-memory.dmp

Filesize
64KB

Download