Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24/02/2024, 00:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a0b53d45cbda284994b819c8cd10530c.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
a0b53d45cbda284994b819c8cd10530c.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
a0b53d45cbda284994b819c8cd10530c.exe
-
Size
6.1MB
-
MD5
a0b53d45cbda284994b819c8cd10530c
-
SHA1
5434413b722c4d66453d8ea234b7ef560cd8ec67
-
SHA256
2ebb208b3eee8ae5e2408617799ad37c87fa0eb5c020bedd25b1c0ce801ca70b
-
SHA512
0bf484d302b90af055ec17f15ae140b4001b00a04c0cf3a53e7201f9e67621df7a8d4fd1f6ec432a0ea3654ebedc362e4e914f758969071fe281b84abf6f6c04
-
SSDEEP
196608:kdWGuWW+1JQTHd0BGN0koepw1RygUGdlWV/MH1Vxz:uWGeAJQ50y/0eMV
Score
8/10
Malware Config
Signatures
-
Downloads MZ/PE file
-
Deletes itself 1 IoCs
pid Process 2944 a0b53d45cbda284994b819c8cd10530c.exe -
Executes dropped EXE 1 IoCs
pid Process 2944 a0b53d45cbda284994b819c8cd10530c.exe -
Loads dropped DLL 1 IoCs
pid Process 808 a0b53d45cbda284994b819c8cd10530c.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2944 a0b53d45cbda284994b819c8cd10530c.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 808 a0b53d45cbda284994b819c8cd10530c.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 808 a0b53d45cbda284994b819c8cd10530c.exe Token: SeDebugPrivilege 2944 a0b53d45cbda284994b819c8cd10530c.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 808 a0b53d45cbda284994b819c8cd10530c.exe 808 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe 2944 a0b53d45cbda284994b819c8cd10530c.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 808 wrote to memory of 2944 808 a0b53d45cbda284994b819c8cd10530c.exe 28 PID 808 wrote to memory of 2944 808 a0b53d45cbda284994b819c8cd10530c.exe 28 PID 808 wrote to memory of 2944 808 a0b53d45cbda284994b819c8cd10530c.exe 28 PID 808 wrote to memory of 2944 808 a0b53d45cbda284994b819c8cd10530c.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0b53d45cbda284994b819c8cd10530c.exe"C:\Users\Admin\AppData\Local\Temp\a0b53d45cbda284994b819c8cd10530c.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\a0b53d45cbda284994b819c8cd10530c.exeC:\Users\Admin\AppData\Local\Temp\a0b53d45cbda284994b819c8cd10530c.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2944
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.5MB
MD5aba786cca9b7c34082e4e55a50792e78
SHA1ee897210e12b5d4821ba8673f1bf765dbb513c14
SHA256184abe0255004abfda4c8530d3b92764c32b80e64552e44296b77230b8db237b
SHA512f25d266b4c4153797aff20a76ac5584d18627382b0bd42d64e72dc831c429a15e92f2ddec096a55747f478063e481c1d20314e7a6d5335bfd0031e006da4bc26
-
Filesize
3.7MB
MD5b471c98176ca63659b98c35f5051f2f8
SHA177d290fc7e231fd169c4648f087ead9c3109912c
SHA25601787a4d39d4afad8c03276f53538be3c59fe5486deca607f480a8f2b16cc05c
SHA512786d72c9fd06962b9ef5bd8796351df0c117cd07745bd5815395e96de534fce0462b44499b9d8aa6660f72ea2c3e14528892d2183bf3b76e007f192f2beb94f3
-
Filesize
4.5MB
MD5390416a4798793a565e1c4ad762ed627
SHA1defcb61271d3f99acb7209c142ffd84a5a8c3f33
SHA2560469b8bd7eb6db154edf781d808a30bee09d6fc0f888054f38f7c5d208e88d68
SHA512fbbfed194cd15ed2bd2edaed3f83d03f68259823e2ff4ce923f158dbff03ff5db784a5db3d229eaf3179900cb7a2495c6e0868df2425487553356eb84e1242ce