Overview

overview

7

Static

static

3

eb8d529d8b...60.exe

windows7-x64

7

eb8d529d8b...60.exe

windows10-2004-x64

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231201-en
  • resource tags

    arch:x64arch:x86image:win7-20231201-enlocale:en-usos:windows7-x64system
  • submitted
    08-12-2023 12:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    eb8d529d8bfef2490cac29b9164747a20b7b35f5d9c95d804f35063b89ced160.exe

  • Size

    1.0MB

  • MD5

    1d17fe888acd6925aea0873f960c1ef9

  • SHA1

    ee25912e968672ea0fc86afae694934d85b95b7c

  • SHA256

    eb8d529d8bfef2490cac29b9164747a20b7b35f5d9c95d804f35063b89ced160

  • SHA512

    eef7e546886aa9280ba9be406a767d09ec6886f58fc90f4802ec4f4749b99f171f280f5a8c4493dde746a1d84c61f772cf2fddc62a1ca2b5f63919386880be42

  • SSDEEP

    24576:KOZfhw007QHFaPQlcr4mrO9oSxPi2qvOwBrDqi:19eelrc4mrjSxq2WfH

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eb8d529d8bfef2490cac29b9164747a20b7b35f5d9c95d804f35063b89ced160.exe
    "C:\Users\Admin\AppData\Local\Temp\eb8d529d8bfef2490cac29b9164747a20b7b35f5d9c95d804f35063b89ced160.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:2472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\XWRtm00_{FC471E17-C53A-2AF8-0237-CDC69D5167C3}.dll
    Filesize

    113KB

    MD5

    f45589ea62da9fc470776bb40bae1f7e

    SHA1

    19f81b3070c94bc00f19048e8c77963a054a302a

    SHA256

    4fc73ae9743794896c04e4391f32d52de8a0323a1507bc9dc4a3b5df2035f180

    SHA512

    e0e7d21acce68deb159f3a811b12f16ed66c3bdbcda26374abed2bae9ba3d1c9f6e246cf7bf4b28f25f35f4d6c3b0c9cbc1141152a3a6d53edd8384cf29d1a4c

    Download Submit
  • memory/2472-0-0x000000013F4D0000-0x000000013F5D8000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/2472-1-0x000007FEF5300000-0x000007FEF5CEC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/2472-2-0x000000001B5D0000-0x000000001B6A6000-memory.dmp
    Filesize

    856KB

    Download
  • memory/2472-3-0x000000013F5B5000-0x000000013F5B6000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2472-18-0x000007FEF5300000-0x000007FEF5CEC000-memory.dmp
    Filesize

    9.9MB

    Download