Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
09-10-2023 00:40
Static task
static1
Behavioral task
behavioral1
Sample
2099ce18e415b258322aa96b87268e063d698ba95926f0d82a388b041e0b09ab.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2099ce18e415b258322aa96b87268e063d698ba95926f0d82a388b041e0b09ab.exe
Resource
win10v2004-20230915-en
General
-
Target
2099ce18e415b258322aa96b87268e063d698ba95926f0d82a388b041e0b09ab.exe
-
Size
2.3MB
-
MD5
e7b32ccfc0178114794ed0da392d7d97
-
SHA1
35110c2537aadf5cfae0c528eb3d4e72ead1c6bf
-
SHA256
2099ce18e415b258322aa96b87268e063d698ba95926f0d82a388b041e0b09ab
-
SHA512
c5353f5ac2cf4b19189378a868f7826974364629ce3e2f99c0da182c39e29d762257250e7c72804975ea1bd948c5a308729ab73d83660e6810c98c9497285d42
-
SSDEEP
24576:qLn9GmQliEEtVlnmFwYcDbGHWAlmandRFElNYc53fDrZmr5uvKN8gQ1KX4wcfodH:wx7mmCWAhnA5Pg18rfG
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
pid Process 2260 2099ce18e415b258322aa96b87268e063d698ba95926f0d82a388b041e0b09ab.exe 2260 2099ce18e415b258322aa96b87268e063d698ba95926f0d82a388b041e0b09ab.exe 2260 2099ce18e415b258322aa96b87268e063d698ba95926f0d82a388b041e0b09ab.exe 2260 2099ce18e415b258322aa96b87268e063d698ba95926f0d82a388b041e0b09ab.exe 2260 2099ce18e415b258322aa96b87268e063d698ba95926f0d82a388b041e0b09ab.exe 2260 2099ce18e415b258322aa96b87268e063d698ba95926f0d82a388b041e0b09ab.exe 2260 2099ce18e415b258322aa96b87268e063d698ba95926f0d82a388b041e0b09ab.exe 2260 2099ce18e415b258322aa96b87268e063d698ba95926f0d82a388b041e0b09ab.exe 2260 2099ce18e415b258322aa96b87268e063d698ba95926f0d82a388b041e0b09ab.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2260 2099ce18e415b258322aa96b87268e063d698ba95926f0d82a388b041e0b09ab.exe 2260 2099ce18e415b258322aa96b87268e063d698ba95926f0d82a388b041e0b09ab.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2099ce18e415b258322aa96b87268e063d698ba95926f0d82a388b041e0b09ab.exe"C:\Users\Admin\AppData\Local\Temp\2099ce18e415b258322aa96b87268e063d698ba95926f0d82a388b041e0b09ab.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2260