Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
09-10-2023 01:32
Static task
static1
Behavioral task
behavioral1
Sample
c8f92159bbc82311124af0c8d061084345dcaa37e23ab369645810bc502b580d.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
c8f92159bbc82311124af0c8d061084345dcaa37e23ab369645810bc502b580d.exe
Resource
win10v2004-20230915-en
General
-
Target
c8f92159bbc82311124af0c8d061084345dcaa37e23ab369645810bc502b580d.exe
-
Size
1.9MB
-
MD5
e2252983af394bbce631e5ab0382dd05
-
SHA1
774466f3efcaa08d6513c14a3e87a3fd3921ac99
-
SHA256
c8f92159bbc82311124af0c8d061084345dcaa37e23ab369645810bc502b580d
-
SHA512
51ae0a727efcf2542e3a75a8c324db57227d264cc232d232dba1f26e7d06618056b59f502dd4c1873300b8c2bfcbc1593c8aa216073d3c818dfb8dcfa7a5acf7
-
SSDEEP
24576:TLhdAQJ6cJGGRY/cO+FSTsM415tD6w+wstLP/LUFjY71V3DL9gTbzjD9lt:ZiCY/sFSVUPDV+n7LGczL4/jD93
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 3020 c8f92159bbc82311124af0c8d061084345dcaa37e23ab369645810bc502b580d.exe 3020 c8f92159bbc82311124af0c8d061084345dcaa37e23ab369645810bc502b580d.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3020 c8f92159bbc82311124af0c8d061084345dcaa37e23ab369645810bc502b580d.exe 3020 c8f92159bbc82311124af0c8d061084345dcaa37e23ab369645810bc502b580d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8f92159bbc82311124af0c8d061084345dcaa37e23ab369645810bc502b580d.exe"C:\Users\Admin\AppData\Local\Temp\c8f92159bbc82311124af0c8d061084345dcaa37e23ab369645810bc502b580d.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:3020