c375345e36b90ee4885819d6104215fb5fc1451c353e0297dbd53ac3b8ddf126

Analysis

max time kernel
142s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11/04/2023, 19:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

72519644f7fbcc4f77792034a66482e7932828e9bd306e2de0f05a363c0352f4.exe
Size

27.5MB
MD5

03673dee34e73aea76f94a675510d3c3
SHA1

6230b90281e0079597b4f2e62b61c4c163ca0363
SHA256

72519644f7fbcc4f77792034a66482e7932828e9bd306e2de0f05a363c0352f4
SHA512

c545d2d5bc3c207576aab67142fc5bca25d7c3d6bd83d7de0a84611c7c86ebd8a9552e71f41371510618f54d2789f94ca6d4c9deca5fda8bb9bc59b967db4fe6
SSDEEP

393216:JnNomAHbMkGoL+Cp8UY1WKBNQYGlDJk3zP+DKdoZGd4NDwyDS7DI/U2/9yBBiMsh:pNom3Bx0K0VzNS4GeTws

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
1580	72519644f7fbcc4f77792034a66482e7932828e9bd306e2de0f05a363c0352f4.exe
1580	72519644f7fbcc4f77792034a66482e7932828e9bd306e2de0f05a363c0352f4.exe
1580	72519644f7fbcc4f77792034a66482e7932828e9bd306e2de0f05a363c0352f4.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1580	72519644f7fbcc4f77792034a66482e7932828e9bd306e2de0f05a363c0352f4.exe
1580	72519644f7fbcc4f77792034a66482e7932828e9bd306e2de0f05a363c0352f4.exe
1580	72519644f7fbcc4f77792034a66482e7932828e9bd306e2de0f05a363c0352f4.exe
1580	72519644f7fbcc4f77792034a66482e7932828e9bd306e2de0f05a363c0352f4.exe
1580	72519644f7fbcc4f77792034a66482e7932828e9bd306e2de0f05a363c0352f4.exe
1580	72519644f7fbcc4f77792034a66482e7932828e9bd306e2de0f05a363c0352f4.exe
1580	72519644f7fbcc4f77792034a66482e7932828e9bd306e2de0f05a363c0352f4.exe
1580	72519644f7fbcc4f77792034a66482e7932828e9bd306e2de0f05a363c0352f4.exe
1580	72519644f7fbcc4f77792034a66482e7932828e9bd306e2de0f05a363c0352f4.exe
1580	72519644f7fbcc4f77792034a66482e7932828e9bd306e2de0f05a363c0352f4.exe
1580	72519644f7fbcc4f77792034a66482e7932828e9bd306e2de0f05a363c0352f4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1580	72519644f7fbcc4f77792034a66482e7932828e9bd306e2de0f05a363c0352f4.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 1484	1580	72519644f7fbcc4f77792034a66482e7932828e9bd306e2de0f05a363c0352f4.exe	29
PID 1580 wrote to memory of 1484	1580	72519644f7fbcc4f77792034a66482e7932828e9bd306e2de0f05a363c0352f4.exe	29
PID 1580 wrote to memory of 1484	1580	72519644f7fbcc4f77792034a66482e7932828e9bd306e2de0f05a363c0352f4.exe	29

C:\Users\Admin\AppData\Local\Temp\72519644f7fbcc4f77792034a66482e7932828e9bd306e2de0f05a363c0352f4.exe
"C:\Users\Admin\AppData\Local\Temp\72519644f7fbcc4f77792034a66482e7932828e9bd306e2de0f05a363c0352f4.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c set
  2⤵
  PID:1484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1580-54-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Filesize
3.8MB

Download
memory/1580-56-0x0000000356B30000-0x0000000356DE3000-memory.dmp

Filesize
2.7MB

Download
memory/1580-60-0x0000000001740000-0x0000000001750000-memory.dmp

Filesize
64KB

Download
memory/1580-64-0x000000037C1A0000-0x000000037C231000-memory.dmp

Filesize
580KB

Download
memory/1580-68-0x00000002E3650000-0x00000002E3666000-memory.dmp

Filesize
88KB

Download
memory/1580-69-0x0000000140000000-0x0000000144AC8000-memory.dmp

Filesize
74.8MB

Download
memory/1580-70-0x0000000140000000-0x0000000144AC8000-memory.dmp

Filesize
74.8MB

Download
memory/1580-71-0x0000000140000000-0x0000000144AC8000-memory.dmp

Filesize
74.8MB

Download
memory/1580-73-0x00000002E3650000-0x00000002E3666000-memory.dmp

Filesize
88KB

Download
memory/1580-72-0x000000037C1A0000-0x000000037C231000-memory.dmp

Filesize
580KB

Download
memory/1580-74-0x0000000140000000-0x0000000144AC8000-memory.dmp

Filesize
74.8MB

Download
memory/1580-75-0x0000000140000000-0x0000000144AC8000-memory.dmp

Filesize
74.8MB

Download
memory/1580-76-0x0000000140000000-0x0000000144AC8000-memory.dmp

Filesize
74.8MB

Download
memory/1580-77-0x0000000140000000-0x0000000144AC8000-memory.dmp

Filesize
74.8MB

Download
memory/1580-79-0x00000000777E0000-0x00000000777F0000-memory.dmp

Filesize
64KB

Download
memory/1580-78-0x0000000001750000-0x0000000001760000-memory.dmp

Filesize
64KB

Download
memory/1580-80-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Filesize
3.8MB

Download
memory/1580-81-0x0000000356B30000-0x0000000356DE3000-memory.dmp

Filesize
2.7MB

Download
memory/1580-82-0x0000000140000000-0x0000000144AC8000-memory.dmp

Filesize
74.8MB

Download
memory/1580-83-0x00000002E3650000-0x00000002E3666000-memory.dmp

Filesize
88KB

Download
memory/1580-84-0x0000000140000000-0x0000000144AC8000-memory.dmp

Filesize
74.8MB

Download
memory/1580-95-0x0000000140000000-0x0000000144AC8000-memory.dmp

Filesize
74.8MB

Download