Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24/05/2023, 01:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
Resource
win7-20230220-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
-
Size
8.3MB
-
MD5
71e83ee2d42e1d3a0714c7791675fd83
-
SHA1
7dccf3322913ee83070bfaa461a05b54486d8d52
-
SHA256
aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de
-
SHA512
ecfd5e04c6b930534d1c9736cce9abd487c01a9f6219961bcfe7b9ff360dff89886849b875ae290adbb72d53b604f35564259b911aa1148ecf54289b84813f7d
-
SSDEEP
196608:jWqVkkK1ilhlXpUZhemwD65z08tBUsVDS3yAeaBX:ZVkd8lXpkl35I8tB9q
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\System32\d3dx11_43.dll aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe File created C:\Windows\System32\d3dcompiler_43.dll aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe File created C:\Windows\System32\d3dx9_43.dll aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4440 aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe"C:\Users\Admin\AppData\Local\Temp\aab88b30ccf68af416a2846ada00fd5c4ca17976b334e08686490634e03869de.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4440
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD5ada0c39d4eacdc81fd84163a95d62079
SHA1207321f1b449985b2d06ed50b989fa6259e4eb8e
SHA25644c3a7e330b54a35a9efa015831392593aa02e7da1460be429d17c3644850e8a
SHA5121afc63db5d2030b76abc19094fc9fef28cc6250bd265294647e65db81f13749c867722924460f7a6021c739f4057f95501f0322cdec28a2101bf94164557a1a5
-
Filesize
270KB
MD59d6429f410597750b2dc2579b2347303
SHA1e35acb15ea52f6cd0587b4ca8da0486b859fd048
SHA256981e42629df751217406e7150477cddc853b79abd6a8568a1566298ed8f7bd59
SHA51246cbfb1e22c3f469bdc80515560448f6f83607fd6974bb68b9c7f86ca10c69878f1312b32c81c0f57b931c43bad80bd46bdf26ab4ffb999abb0b73de27ad7c56