Analysis
-
max time kernel
151s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
22-11-2023 11:40
Static task
static1
Behavioral task
behavioral1
Sample
3b0656bc769eaf5618c4ee3e099554af810e5dc17026818cd2416c947dbb1194.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
3b0656bc769eaf5618c4ee3e099554af810e5dc17026818cd2416c947dbb1194.exe
Resource
win10v2004-20231020-en
General
-
Target
3b0656bc769eaf5618c4ee3e099554af810e5dc17026818cd2416c947dbb1194.exe
-
Size
162.6MB
-
MD5
07946bb0dab1fb8ef2eaa836885c8f1e
-
SHA1
c218e673b8ca569afe881852786a97c854404718
-
SHA256
3b0656bc769eaf5618c4ee3e099554af810e5dc17026818cd2416c947dbb1194
-
SHA512
4f8ca5f1c38ddbadb5c23fb26767b9eb19da38d0fdf0455ee14df1ae96309affaa43647a6d6efac82ada38be8d9294adc85a60346193475005236ff8e28f5b2a
-
SSDEEP
1572864:IkYDr3VLmiVf6T9jCykX7LBZY56W8SGc2+:IkYDrFLmEiT9joQU5c2+
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
pid Process 2928 3b0656bc769eaf5618c4ee3e099554af810e5dc17026818cd2416c947dbb1194.exe 2928 3b0656bc769eaf5618c4ee3e099554af810e5dc17026818cd2416c947dbb1194.exe 2928 3b0656bc769eaf5618c4ee3e099554af810e5dc17026818cd2416c947dbb1194.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2928 3b0656bc769eaf5618c4ee3e099554af810e5dc17026818cd2416c947dbb1194.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\.net\3b0656bc769eaf5618c4ee3e099554af810e5dc17026818cd2416c947dbb1194\GQht0H4FyPxs7fhvcj4O3HiGWF4ddH4=\D3DCompiler_47_cor3.dll
Filesize4.7MB
MD503a60a6652caf4f49ea5912ce4e1b33c
SHA1a0d949d4af7b1048dc55e39d1d1260a1e0660c4f
SHA256b23e7b820ed5c6ea7dcd77817e2cd79f1cec9561d457172287ee634a8bd658c3
SHA5126711d40d171ea200c92d062226a69f33eb41e9232d74291ef6f0202de73cf4dc54fbdd769104d2bb3e89dc2d81f2f2f3479e4258a5d6a54c545e56b07746b4c4
-
\Users\Admin\AppData\Local\Temp\.net\3b0656bc769eaf5618c4ee3e099554af810e5dc17026818cd2416c947dbb1194\GQht0H4FyPxs7fhvcj4O3HiGWF4ddH4=\PresentationNative_cor3.dll
Filesize1.2MB
MD5ef01a6c206c65369dd05ca5aff258aa2
SHA1219cc335309f7a6b48b3aa0554f228d59cfd0e7c
SHA2566342b0b0c9a864e4dca5d6d6d60d31ff4d7f02232d63fb45958035b5db77980e
SHA512c35f31bcc766a0c1d35a82197226222cfe7eb198a4df8b18acfb174a8654fd2b77e20fe5dad7be7c423e293bbb37d0d0b6a763b2fcd93c3bacd80077a14642ad
-
\Users\Admin\AppData\Local\Temp\.net\3b0656bc769eaf5618c4ee3e099554af810e5dc17026818cd2416c947dbb1194\GQht0H4FyPxs7fhvcj4O3HiGWF4ddH4=\wpfgfx_cor3.dll
Filesize1.9MB
MD51bd451c0ea27f1c3cbaf428e11c6ffe6
SHA130ed8e98b08ecf3c583e81d78258a292780bc755
SHA256292f74c265648690eb26e5008f4aa4ffd8774ed33682296970a063535340ebc5
SHA5129b7f7511b7b6eaedcdba7095aa4129b653650c8be5f889055c6649242aa6c3119c26ca54e9329dd3d683955ffa99125585e8d37e915bf4e9924f86c76d50e9af