Analysis
-
max time kernel
564s -
max time network
593s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
20-08-2023 22:16
General
-
Target
labymod4-installer.exe
-
Size
4.5MB
-
MD5
ff808f2bcef1b2d33eeee8678fa2c42d
-
SHA1
c1f640a45ee396f4dc70bb50ead02b0899a66122
-
SHA256
357d5e993e6ff9d91b2c49d4bc01a0aea465b737c0e8bc21b4cf21ff1a6824bb
-
SHA512
dff690c735b63fcadb0f981f792eed77f7c5af58b0f11f03d365bf3b75da04fb2898d48ab6621e979f5a81aa27856ddedef0949ef2e9bc1dcc98daf98b536b87
-
SSDEEP
98304:q2RqljXnSurf6OJRF1/o+tBOS32jXaq4LVTgIp+LD/CQKLSPq:qZdNVo+t72jXuZGCNSi
Malware Config
Signatures
-
Drops file in System32 directory 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\labymod4-installer.exe"C:\Users\Admin\AppData\Local\Temp\labymod4-installer.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5c01eaa0bdcd7c30a42bbb35a9acbf574
SHA10aee3e1b873e41d040f1991819d0027b6cc68f54
SHA25632297224427103aa1834dba276bf5d49cd5dd6bda0291422e47ad0d0706c6d40
SHA512d26ff775ad39425933cd3df92209faa53ec5b701e65bfbcccc64ce8dd3e79f619a9bad7cc975a98a95f2006ae89e50551877fc315a3050e48d5ab89e0802e2b7
-
Filesize
29KB
MD5f5afcf4c8f35e970d6e319a63ab43eb2
SHA17c46c2a8fcf7e42c208b83917097f9725c533502
SHA2564e426ea50ad5d586006be30cbe9e00c7e358a6286731735e1e0192778be2b1f6
SHA512a4d2ad9b001f5cf842092e75b673c0975c798c982e48f6dc09ccca4a95182e24e9813b57ef6fe6dc9b8c65528e1efd5e717b001dbaf63aab59124b666fd6b172
-
Filesize
29KB
MD5a6892da14d80989feb9cad1aba8f6056
SHA1e41758afb5f59be2302ef3190885c64addd4d126
SHA2562df73ff005802aaef67d2593b15d682c5a89893c452b2e501496ce562b917b9e
SHA512234cbb35a3a7bde09a47272f1ef864ec579aa8b84103c358b695cecd72599490bc8088f89cda1a25ddd773ea44b61aa752676ef5d3708af96cf0733326bd4c42
-
Filesize
29KB
MD50c0194be222daf2b52e6c0ac577c67e2
SHA18b6e4ca3c2cbd417be3804a30dbc762ec2076e9a
SHA256d41dcbd5530430697a61e7a4182617a9fc482006447537aa45eaa60131c96bb3
SHA5122ed9bfb0ef9735e1b18aa5e5754ce04d55735b54b52538a009b084875fd1752099f46f56e1863d6d2686fafd2a87d79408b2b397f43bdf92104bd6415bebc232
-
Filesize
29KB
MD5f912211f08763616c7db47178802cf51
SHA13cf9c9fa32cee5b3b9908d777aea3ad6afa17f4f
SHA256d13665ceb4a37d9bf4702ec6492d416c704e86d7f692c47abf9bfee1173ed8a9
SHA512f74271e7aa83c80a8e5b957659e460a306cd5127618540d1ac1a0300d19141658d572d2a614d6747c76f6565c2637b2f6e64743ee516a59bca7d0bd58992b9ae
-
Filesize
29KB
MD51b5a164a80a76939c47ecf45401fde86
SHA17448c5e5e81faffc0687f9f68c78612dceb9f98b
SHA256d9c88c2208e9f98654c43f8c8581e40b7c6eed4c00e6e78bd48554747f0d1fa0
SHA5129cda0a7cc8fdc79dcf8b3f5e11e108fa308e96da5b3f67d800cab8b94991c7e47257ec85a106c52b2c3782fbb7805ce854cf6edd7c08eba6f9f96ff9bd4e56ca
-
Filesize
29KB
MD521cbccc451b4c19552fb56f7e74ed322
SHA1cc197b7ee6e9dee4147518e59d741ce63caefece
SHA256c920a5a116c57d210bf85ae44c3a892679bb5d16a0c0b454c408578934b4c48c
SHA51227da168c8ac155d543a4e5b933569f320b1b771ef70f82abc6ac10382d7b73eefc556e14da18c33a597a8113b564f2ea82011ee9981f35f407be915ed15929b3
-
Filesize
29KB
MD5fde09e30ad9623a8811360c438918d34
SHA1c574d468b5fdc465981334d7d9c68655e25ae4a9
SHA256a782c46254d2c50ee95b9b543988843993af35155ed6a569fc3d8123c49b74d1
SHA512883c41714c571a7a3fabe733a76073d0f3bffec4fcccd57aa4e55afdcbda87a445f1c7a4993f23336b097e824a24bc063bfe3a84f63402949b3e3299e14b6f88
-
Filesize
29KB
MD50be7fc810d7e1fa1a290c66ed16eab84
SHA144f1e134407ef1c996544552472bea8c509d17d0
SHA2563f78dbfd52c4429b51fcfb86cabf2cac256543869487b7d7a74b982a82c94d3a
SHA512bb20e0a695836e1b4d3a7d2b708b51538819a2af579552b3ec00264d552cffcd7f7e75d5a68f5eed061960e5643bb7777d0cd87696a039307003d9922637dd8d
-
Filesize
29KB
MD5470fdb92c5562a4070a1100ae1c1d952
SHA129f41342fd591101fff8723b844495e968aaac5c
SHA25613fc5bf17d52b5463e90e777ea4a4cfaa1f0a915db9336545aa092384d5acc2c
SHA5123707188bbd15467fe9b0e6af494f0d2ca5e703c1e9aaa1937fa578ad6368ee6049ffab256ef77459683b47a3beb9c1d3e4ad419d441013cb339a377ccc780480
-
Filesize
29KB
MD5ef6df42e4cfe4dfa8f6d1d1a98b3c718
SHA1bdae5d3380a75dd8166346ed1e2e47279df0b4e4
SHA256bda2dfb56a5299e66be6fe7300e6256c1ba72a187bf05259a8609563a24c92d2
SHA5126c21a81578f36d367fb6ec025810ce0ef766b0f41340137833ae311e31eac66a75becbcb8f9f419b38243c5b87b4fe31f87b1eac75017cae61994925f15af9f3
-
Filesize
29KB
MD5a6262ab4f9e8c8faa874c6b1ab430689
SHA1dc39c3f01de3e15bf018c8ac52f0e951c9e5c77d
SHA25664c83b46ed24d776b9e61b8b09d68039a1cbc6bee64e4b1f7da1e1d309fc7dd1
SHA512c059a8580c5713f2b2bcc481ac68ec91ccbbf28b701fb8fbd7111a8690a5ecc5adb3e671ee669a7d6929914453468392c3d881244d2411e1b0060a159afcf34d
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
7.6MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
4.5MB
-
Filesize
5.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB