Analysis
-
max time kernel
141s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
28/08/2023, 06:21
General
-
Target
fb5b8381c896aa6908b76900fa1e2f75f653a64ec4d00b3afbc8a81fcf07eba7.exe
-
Size
8.7MB
-
MD5
e8e8cf7821915da7b1f04ff6930b7e07
-
SHA1
6fd4bb8a777cb4c732d319fc7b485e5a01037030
-
SHA256
fb5b8381c896aa6908b76900fa1e2f75f653a64ec4d00b3afbc8a81fcf07eba7
-
SHA512
54258afa73d1af5589a9f8db3d30a3db37c00c1d505bbf5fce3e93bb7e1ceb4b965cd9ddc8da596d5a6f8af472ba1426e2b216f8d00a22038f60f1ae290a25a6
-
SSDEEP
196608:D6nmOG+MxcBD0kvbbVViXEoyxf+lHb6e6SQDi46eE7wUAwGDx0cJDR:D6nmOG+MSg6b6XEoN6SQDiRbw2KDR
Malware Config
Signatures
-
Loads dropped DLL 7 IoCs
-
Themida packer 18 IoCs
Detects Themida, an advanced Windows software protection system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb5b8381c896aa6908b76900fa1e2f75f653a64ec4d00b3afbc8a81fcf07eba7.exe"C:\Users\Admin\AppData\Local\Temp\fb5b8381c896aa6908b76900fa1e2f75f653a64ec4d00b3afbc8a81fcf07eba7.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 3842⤵
- Loads dropped DLL
- Program crash
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.7MB
MD5e8e8cf7821915da7b1f04ff6930b7e07
SHA16fd4bb8a777cb4c732d319fc7b485e5a01037030
SHA256fb5b8381c896aa6908b76900fa1e2f75f653a64ec4d00b3afbc8a81fcf07eba7
SHA51254258afa73d1af5589a9f8db3d30a3db37c00c1d505bbf5fce3e93bb7e1ceb4b965cd9ddc8da596d5a6f8af472ba1426e2b216f8d00a22038f60f1ae290a25a6
-
Filesize
8.7MB
MD5e8e8cf7821915da7b1f04ff6930b7e07
SHA16fd4bb8a777cb4c732d319fc7b485e5a01037030
SHA256fb5b8381c896aa6908b76900fa1e2f75f653a64ec4d00b3afbc8a81fcf07eba7
SHA51254258afa73d1af5589a9f8db3d30a3db37c00c1d505bbf5fce3e93bb7e1ceb4b965cd9ddc8da596d5a6f8af472ba1426e2b216f8d00a22038f60f1ae290a25a6
-
Filesize
8.7MB
MD5e8e8cf7821915da7b1f04ff6930b7e07
SHA16fd4bb8a777cb4c732d319fc7b485e5a01037030
SHA256fb5b8381c896aa6908b76900fa1e2f75f653a64ec4d00b3afbc8a81fcf07eba7
SHA51254258afa73d1af5589a9f8db3d30a3db37c00c1d505bbf5fce3e93bb7e1ceb4b965cd9ddc8da596d5a6f8af472ba1426e2b216f8d00a22038f60f1ae290a25a6
-
Filesize
8.7MB
MD5e8e8cf7821915da7b1f04ff6930b7e07
SHA16fd4bb8a777cb4c732d319fc7b485e5a01037030
SHA256fb5b8381c896aa6908b76900fa1e2f75f653a64ec4d00b3afbc8a81fcf07eba7
SHA51254258afa73d1af5589a9f8db3d30a3db37c00c1d505bbf5fce3e93bb7e1ceb4b965cd9ddc8da596d5a6f8af472ba1426e2b216f8d00a22038f60f1ae290a25a6
-
Filesize
8.7MB
MD5e8e8cf7821915da7b1f04ff6930b7e07
SHA16fd4bb8a777cb4c732d319fc7b485e5a01037030
SHA256fb5b8381c896aa6908b76900fa1e2f75f653a64ec4d00b3afbc8a81fcf07eba7
SHA51254258afa73d1af5589a9f8db3d30a3db37c00c1d505bbf5fce3e93bb7e1ceb4b965cd9ddc8da596d5a6f8af472ba1426e2b216f8d00a22038f60f1ae290a25a6
-
Filesize
8.7MB
MD5e8e8cf7821915da7b1f04ff6930b7e07
SHA16fd4bb8a777cb4c732d319fc7b485e5a01037030
SHA256fb5b8381c896aa6908b76900fa1e2f75f653a64ec4d00b3afbc8a81fcf07eba7
SHA51254258afa73d1af5589a9f8db3d30a3db37c00c1d505bbf5fce3e93bb7e1ceb4b965cd9ddc8da596d5a6f8af472ba1426e2b216f8d00a22038f60f1ae290a25a6
-
Filesize
8.7MB
MD5e8e8cf7821915da7b1f04ff6930b7e07
SHA16fd4bb8a777cb4c732d319fc7b485e5a01037030
SHA256fb5b8381c896aa6908b76900fa1e2f75f653a64ec4d00b3afbc8a81fcf07eba7
SHA51254258afa73d1af5589a9f8db3d30a3db37c00c1d505bbf5fce3e93bb7e1ceb4b965cd9ddc8da596d5a6f8af472ba1426e2b216f8d00a22038f60f1ae290a25a6
-
Filesize
17.2MB
-
Filesize
17.2MB
-
Filesize
17.2MB
-
Filesize
17.2MB
-
Filesize
17.2MB
-
Filesize
17.2MB
-
Filesize
17.2MB
-
Filesize
17.2MB
-
Filesize
17.2MB
-
Filesize
17.2MB
-
Filesize
17.2MB
-
Filesize
8KB