Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
26-08-2023 21:25
Behavioral task
behavioral1
Sample
avicap32.exe
Resource
win7-20230712-en
windows7-x64
6 signatures
150 seconds
General
-
Target
avicap32.exe
-
Size
6.1MB
-
MD5
8570d48a1291cc62a902b06b7429b2dd
-
SHA1
6f7de617e02b655c01e734e9ea30bfdfb4caaa24
-
SHA256
729c7829cb055679d29b496693a55814c1a493c7c4a68ab7c121ee5e4745c430
-
SHA512
43970a17e5d27801dd8306b5b228bc1ce300c07ddf9801775ea52b87d73fa96041160927ca23c5e4b98046f8aadc6973e9fda58d9bfeac25399370295c053af0
-
SSDEEP
196608:1nXtfIhfnpg/2hk57yqx256vfOCv8q+M/VX:1nXtfIhfnpg/2hk57yqxvf1f+MZ
Malware Config
Extracted
Family
allcome
C2
http://dba692117be7b6d3480fe5220fdd58b38bf.xyz/API/2/configure.php?cf6zrlhn=finarnw
Signatures
-
resource yara_rule behavioral1/memory/3036-13-0x0000000000310000-0x000000000092A000-memory.dmp themida behavioral1/memory/2832-46-0x0000000000310000-0x000000000092A000-memory.dmp themida behavioral1/memory/3036-63-0x0000000000310000-0x000000000092A000-memory.dmp themida behavioral1/memory/2832-73-0x0000000000310000-0x000000000092A000-memory.dmp themida -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3036 set thread context of 2832 3036 avicap32.exe 28 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3036 avicap32.exe 3036 avicap32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3036 avicap32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3036 wrote to memory of 2832 3036 avicap32.exe 28 PID 3036 wrote to memory of 2832 3036 avicap32.exe 28 PID 3036 wrote to memory of 2832 3036 avicap32.exe 28 PID 3036 wrote to memory of 2832 3036 avicap32.exe 28 PID 3036 wrote to memory of 2832 3036 avicap32.exe 28 PID 3036 wrote to memory of 2832 3036 avicap32.exe 28 PID 3036 wrote to memory of 2832 3036 avicap32.exe 28 PID 3036 wrote to memory of 2832 3036 avicap32.exe 28 PID 3036 wrote to memory of 2832 3036 avicap32.exe 28 PID 3036 wrote to memory of 2832 3036 avicap32.exe 28 PID 3036 wrote to memory of 2832 3036 avicap32.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\avicap32.exe"C:\Users\Admin\AppData\Local\Temp\avicap32.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\avicap32.exe"C:\Users\Admin\AppData\Local\Temp\avicap32.exe"2⤵PID:2832
-