Analysis
-
max time kernel
1623s -
max time network
1446s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
30/08/2023, 14:23
General
-
Target
sadio3d.exe
-
Size
5.4MB
-
MD5
a5dab1892e8be7aecf1923f41e16b619
-
SHA1
ceda17ef6ddb899eb9406a1c10eebca902e60f18
-
SHA256
d4bfc6d10803426aa544a6d1b4a31f9d545800178b5a7f8367f30bc9eb415820
-
SHA512
14c9563877f0e8ce891ffe8efed6a3252631f7c5abe434b8539102d945f14f8c79476d68919ae6459347cce36718c5eb51f34e9d3bbcccf15b686530dc2eb876
-
SSDEEP
98304:vjIaXDh6+wOaOlfgLwqxd0Iz3POckkLCTE8o7N1rXILJ0gA2KDRuCEFl/leGb1I:v8aToOzfgUqxLz3mctH7NVyoNDRuCKly
Malware Config
Signatures
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Drops file in System32 directory 3 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\sadio3d.exe"C:\Users\Admin\AppData\Local\Temp\sadio3d.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5c01eaa0bdcd7c30a42bbb35a9acbf574
SHA10aee3e1b873e41d040f1991819d0027b6cc68f54
SHA25632297224427103aa1834dba276bf5d49cd5dd6bda0291422e47ad0d0706c6d40
SHA512d26ff775ad39425933cd3df92209faa53ec5b701e65bfbcccc64ce8dd3e79f619a9bad7cc975a98a95f2006ae89e50551877fc315a3050e48d5ab89e0802e2b7
-
Filesize
29KB
MD542f9bc2d22f133289d8081696dea6aef
SHA146719986d861785ad3b724eaf4d1efe5b93c25ed
SHA256731aaee03c6c382304b8cd1c23075de4c342fde6aeba80be879e274aeb3a12ea
SHA51252dd401bc927a3d3147b703cd4b84d9dafd64294540352811ad4efacb233e92feedcfca1666dbd5a50cd74c1e6750ec0b73f63c3e52d851369934e0839407a0f
-
Filesize
29KB
MD57854dba769f39e0fc7231a5431f60e34
SHA14685c5e37b2b276ace1b5a8195501ce3f61e0857
SHA2568cccfc1d51ce2f0c9f2dab2cf4814f7ecaced9b7ee975bc4db68142638e9df29
SHA5120d404b55f4e5b0b1275ebac10b48c79534dbdb58fa9868c9d563cb38ae344becf49f3ab1598fd13390756396a9092b9dbd6c6d263296d561522cfdedc7a3c939
-
Filesize
29KB
MD5a2f39b862597fca4746b068c9b40a7c1
SHA1aa499d22ff0900db8eb83ab3a8c3b664dda8e047
SHA2562a47fb1b2c740e8b7384ffd77c3d84a774f75a5a19d9f696fb5b590a82bc0bcd
SHA512a74ea33aafcac03b303f3c85142866288269bbbf7dd97b8362b541f23635a81d03fbe8fa2c9f39db8717433cf6fd577ee2cbc8b6c96907bcb6600b91e8043079
-
Filesize
29KB
MD5baa49ebd92d51609454a5a0c17a719ae
SHA1d59ee37bb3f66c5f5089863fd1711d3c8a4bb3cf
SHA25689495c129a46ebf15d6b1e288dd1714344d6d4ed4872760d6da3df9ce8393448
SHA5121c7c5a2d09388bbd02b5550d57eeab27970d238520593079712852ff500fd30bead4ff06b5de044b241e6e3f73daf782a833a462d9487360b8cd4b9803b4a0f8
-
Filesize
29KB
MD5b0d698618970b9232ebb5d41a60fe1e8
SHA15dceb386c8a49d12d30569d8fcd251ceba4f06ec
SHA256a3433e859c858ee5ec9461174eb254b618a95401787e7327032edce545e0994c
SHA512109cf7a959318c539cc85f7d1dc5f1eede88681070e793acf7178cbf9c1ff4434c5fd446255a15b990b9ad63fa7b178c48b527fdfc87e429f6ef16e0fba6be60
-
Filesize
29KB
MD569859c4b57631584caf8d3b2f4c6f035
SHA170b379e30c23cd8a1a71e11093bdbca381bf2e8e
SHA2564d8a9f3e3def2045ac2566c85ae0e1e3c7b54132e7ba76277e9642b0674a90e0
SHA5125c3265464e201f8af434d4f1d333aba084af78daf39f7043b381e8b74201071a325f53bfe76707e0b6ec5b0ac4351121439abb6f0e03a7fe31dfb4b7ad29eb4c
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB