Analysis
-
max time kernel
142s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
24/09/2023, 00:19
Static task
static1
Behavioral task
behavioral1
Sample
63d17e5e9526438cea3c7b41ee4777d74f624c92928bc308ccf27cb55bfb20fe.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
63d17e5e9526438cea3c7b41ee4777d74f624c92928bc308ccf27cb55bfb20fe.exe
Resource
win10v2004-20230915-en
General
-
Target
63d17e5e9526438cea3c7b41ee4777d74f624c92928bc308ccf27cb55bfb20fe.exe
-
Size
12.4MB
-
MD5
a4c534dc8f958d1cf1e55a23424c53f5
-
SHA1
e55fc538921363bce4e75fcffd00de913f1aeefb
-
SHA256
63d17e5e9526438cea3c7b41ee4777d74f624c92928bc308ccf27cb55bfb20fe
-
SHA512
ba53a9d314c36b0667b454dda4df930e7c4a640341ed98638c1e5350233248fd51ce9fb2b97185b960b298258bc1516380b709f00e4f7cf16b50fbfe8a5994a9
-
SSDEEP
196608:+Tv4ZilJ4lVE3+2dpGImtQfKyjiTEX/fhXntchNlJMGhLmfXoqmw1Mc3:YGifCE3bWAKzs3hXnW5JM4Cvoqmw
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2452 63d17e5e9526438cea3c7b41ee4777d74f624c92928bc308ccf27cb55bfb20fe.exe 2452 63d17e5e9526438cea3c7b41ee4777d74f624c92928bc308ccf27cb55bfb20fe.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2452 63d17e5e9526438cea3c7b41ee4777d74f624c92928bc308ccf27cb55bfb20fe.exe 2452 63d17e5e9526438cea3c7b41ee4777d74f624c92928bc308ccf27cb55bfb20fe.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2452 63d17e5e9526438cea3c7b41ee4777d74f624c92928bc308ccf27cb55bfb20fe.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2452 63d17e5e9526438cea3c7b41ee4777d74f624c92928bc308ccf27cb55bfb20fe.exe 2452 63d17e5e9526438cea3c7b41ee4777d74f624c92928bc308ccf27cb55bfb20fe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\63d17e5e9526438cea3c7b41ee4777d74f624c92928bc308ccf27cb55bfb20fe.exe"C:\Users\Admin\AppData\Local\Temp\63d17e5e9526438cea3c7b41ee4777d74f624c92928bc308ccf27cb55bfb20fe.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:2452