Analysis
-
max time kernel
33s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2023 01:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4816d695d08cdefc6a284fc67cd268ce.exe
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
4816d695d08cdefc6a284fc67cd268ce.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
4816d695d08cdefc6a284fc67cd268ce.exe
-
Size
673KB
-
MD5
4816d695d08cdefc6a284fc67cd268ce
-
SHA1
0cbbc8f5bb8ca25b510ca6262869b85dee2d6675
-
SHA256
9b4bb65e2911db3bbd610b6e098ae4cb0b4aafec0a959609362e72bfe607f7f6
-
SHA512
ab0d0985b888da3a4d9713bf64a17f27002307ae66a092211b18e14bc13fb2a734aac8a3237d3d33ec5e480c6ce12e4386b791d5618dff43a3af8c030837790b
-
SSDEEP
12288:q7k2iNb4sWlkNb0Q/hjFm0nUprCV6qoAddEu/NpRYU:Gk1ysWlkF/XSdGHjddEu/
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
4816d695d08cdefc6a284fc67cd268ce.exedescription pid process target process PID 4488 set thread context of 2468 4488 4816d695d08cdefc6a284fc67cd268ce.exe 4816d695d08cdefc6a284fc67cd268ce.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
4816d695d08cdefc6a284fc67cd268ce.exepid process 2468 4816d695d08cdefc6a284fc67cd268ce.exe 2468 4816d695d08cdefc6a284fc67cd268ce.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
4816d695d08cdefc6a284fc67cd268ce.exedescription pid process Token: SeDebugPrivilege 2468 4816d695d08cdefc6a284fc67cd268ce.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
4816d695d08cdefc6a284fc67cd268ce.exedescription pid process target process PID 4488 wrote to memory of 2468 4488 4816d695d08cdefc6a284fc67cd268ce.exe 4816d695d08cdefc6a284fc67cd268ce.exe PID 4488 wrote to memory of 2468 4488 4816d695d08cdefc6a284fc67cd268ce.exe 4816d695d08cdefc6a284fc67cd268ce.exe PID 4488 wrote to memory of 2468 4488 4816d695d08cdefc6a284fc67cd268ce.exe 4816d695d08cdefc6a284fc67cd268ce.exe PID 4488 wrote to memory of 2468 4488 4816d695d08cdefc6a284fc67cd268ce.exe 4816d695d08cdefc6a284fc67cd268ce.exe PID 4488 wrote to memory of 2468 4488 4816d695d08cdefc6a284fc67cd268ce.exe 4816d695d08cdefc6a284fc67cd268ce.exe PID 4488 wrote to memory of 2468 4488 4816d695d08cdefc6a284fc67cd268ce.exe 4816d695d08cdefc6a284fc67cd268ce.exe PID 4488 wrote to memory of 2468 4488 4816d695d08cdefc6a284fc67cd268ce.exe 4816d695d08cdefc6a284fc67cd268ce.exe PID 4488 wrote to memory of 2468 4488 4816d695d08cdefc6a284fc67cd268ce.exe 4816d695d08cdefc6a284fc67cd268ce.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4816d695d08cdefc6a284fc67cd268ce.exe"C:\Users\Admin\AppData\Local\Temp\4816d695d08cdefc6a284fc67cd268ce.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\4816d695d08cdefc6a284fc67cd268ce.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2468 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 17883⤵PID:4056