Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
14-02-2024 02:45
Static task
static1
Behavioral task
behavioral1
Sample
9a8e195910de451cc785679c38e50196.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9a8e195910de451cc785679c38e50196.exe
Resource
win10v2004-20231215-en
General
-
Target
9a8e195910de451cc785679c38e50196.exe
-
Size
475KB
-
MD5
9a8e195910de451cc785679c38e50196
-
SHA1
4a52016581f10e6ccae98889700e50eb5138aa89
-
SHA256
15cf685e8aaada79ceb1efef5d93f30092754adc8d1d58088beb1d1dceb5426a
-
SHA512
e838795c3e6ecabb6e71b2321319efb78a9b6e0575e89634bf8b3120420e0fdbe03edc45b6274cbd99facbe0dd7733e21802855451700b3d9b546adcf625985a
-
SSDEEP
12288:gYOUJAyVEO8kV0fJOFBezrlMpF2IqcYPoxmtF9Z:1JAySfJOCtMpRqcwoxmf9Z
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1532 yhiagvicbojqgn.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1532 yhiagvicbojqgn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1532 yhiagvicbojqgn.exe 1532 yhiagvicbojqgn.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 872 wrote to memory of 1532 872 9a8e195910de451cc785679c38e50196.exe 84 PID 872 wrote to memory of 1532 872 9a8e195910de451cc785679c38e50196.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a8e195910de451cc785679c38e50196.exe"C:\Users\Admin\AppData\Local\Temp\9a8e195910de451cc785679c38e50196.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\yhiagvicbojqgn.exe"C:\Users\Admin\AppData\Local\Temp\\yhiagvicbojqgn.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1532
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
475KB
MD59a8e195910de451cc785679c38e50196
SHA14a52016581f10e6ccae98889700e50eb5138aa89
SHA25615cf685e8aaada79ceb1efef5d93f30092754adc8d1d58088beb1d1dceb5426a
SHA512e838795c3e6ecabb6e71b2321319efb78a9b6e0575e89634bf8b3120420e0fdbe03edc45b6274cbd99facbe0dd7733e21802855451700b3d9b546adcf625985a
-
Filesize
23KB
MD5831fe278215fcca35b2591bd81bfc398
SHA1b1b37650a6ff8208968d95c3f89fcf52fdafaf0d
SHA2567a19030ab932a63e1d6facc331ee2add06143fc581e9f6c6585eecab6c94d552
SHA512997314ce7bb525f81545474777344aa0c87dbf8eb5ab3a0b2edb843f936527da063ce64a4c47cba0b2bd56f3e9c80245d659a681977013e85380132109664e9e