Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
07/12/2023, 10:27
Behavioral task
behavioral1
Sample
08502acb78bbd00ef679593e152fb7637dbde654a1c542e40de8d03a2f750540.exe
Resource
win7-20231129-en
4 signatures
150 seconds
General
-
Target
08502acb78bbd00ef679593e152fb7637dbde654a1c542e40de8d03a2f750540.exe
-
Size
8.2MB
-
MD5
b24dbc2014faa229ab80b5e891137a49
-
SHA1
f004e7a4cd8649bc74e12edf322243e2a5e794d6
-
SHA256
08502acb78bbd00ef679593e152fb7637dbde654a1c542e40de8d03a2f750540
-
SHA512
cb78d7f7fcff2f13e590ac6f60ca8d05329587815a73df8a30eb8eb6953332bd83ea5a10555af96cf4851f3c33bbf306c887bd8ebc7bae5cf4683e811d463277
-
SSDEEP
196608:czGHLnxSqXBY4tRekoakad5xSgra1NhTqxWLOcWFsRcj+9uL:KG3XBj0koNS5Igra1/qxabK+UL
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2192-17-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2192-21-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2192-29-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2192-43-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2192-46-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2192-57-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2192-59-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2192-55-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2192-53-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2192-61-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2192-51-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2192-49-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2192-41-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2192-39-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2192-37-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2192-35-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2192-33-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2192-31-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2192-27-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2192-25-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2192-23-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2192-19-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2192-16-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2192-15-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2192-14-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2192-12-0x0000000010000000-0x000000001003E000-memory.dmp upx -
resource yara_rule behavioral2/memory/2192-6-0x0000000000400000-0x0000000001355000-memory.dmp vmprotect behavioral2/memory/2192-3-0x0000000000400000-0x0000000001355000-memory.dmp vmprotect behavioral2/memory/2192-60-0x0000000000400000-0x0000000001355000-memory.dmp vmprotect -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2192 08502acb78bbd00ef679593e152fb7637dbde654a1c542e40de8d03a2f750540.exe 2192 08502acb78bbd00ef679593e152fb7637dbde654a1c542e40de8d03a2f750540.exe 2192 08502acb78bbd00ef679593e152fb7637dbde654a1c542e40de8d03a2f750540.exe 2192 08502acb78bbd00ef679593e152fb7637dbde654a1c542e40de8d03a2f750540.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2192 08502acb78bbd00ef679593e152fb7637dbde654a1c542e40de8d03a2f750540.exe 2192 08502acb78bbd00ef679593e152fb7637dbde654a1c542e40de8d03a2f750540.exe 2192 08502acb78bbd00ef679593e152fb7637dbde654a1c542e40de8d03a2f750540.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08502acb78bbd00ef679593e152fb7637dbde654a1c542e40de8d03a2f750540.exe"C:\Users\Admin\AppData\Local\Temp\08502acb78bbd00ef679593e152fb7637dbde654a1c542e40de8d03a2f750540.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2192