Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
24-02-2024 00:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a0b53d45cbda284994b819c8cd10530c.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
a0b53d45cbda284994b819c8cd10530c.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
a0b53d45cbda284994b819c8cd10530c.exe
-
Size
6.1MB
-
MD5
a0b53d45cbda284994b819c8cd10530c
-
SHA1
5434413b722c4d66453d8ea234b7ef560cd8ec67
-
SHA256
2ebb208b3eee8ae5e2408617799ad37c87fa0eb5c020bedd25b1c0ce801ca70b
-
SHA512
0bf484d302b90af055ec17f15ae140b4001b00a04c0cf3a53e7201f9e67621df7a8d4fd1f6ec432a0ea3654ebedc362e4e914f758969071fe281b84abf6f6c04
-
SSDEEP
196608:kdWGuWW+1JQTHd0BGN0koepw1RygUGdlWV/MH1Vxz:uWGeAJQ50y/0eMV
Score
8/10
Malware Config
Signatures
-
Downloads MZ/PE file
-
Deletes itself 1 IoCs
pid Process 1548 a0b53d45cbda284994b819c8cd10530c.exe -
Executes dropped EXE 1 IoCs
pid Process 1548 a0b53d45cbda284994b819c8cd10530c.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1548 a0b53d45cbda284994b819c8cd10530c.exe 1548 a0b53d45cbda284994b819c8cd10530c.exe 1548 a0b53d45cbda284994b819c8cd10530c.exe 1548 a0b53d45cbda284994b819c8cd10530c.exe 1548 a0b53d45cbda284994b819c8cd10530c.exe 1548 a0b53d45cbda284994b819c8cd10530c.exe 1548 a0b53d45cbda284994b819c8cd10530c.exe 1548 a0b53d45cbda284994b819c8cd10530c.exe 1548 a0b53d45cbda284994b819c8cd10530c.exe 1548 a0b53d45cbda284994b819c8cd10530c.exe 1548 a0b53d45cbda284994b819c8cd10530c.exe 1548 a0b53d45cbda284994b819c8cd10530c.exe 1548 a0b53d45cbda284994b819c8cd10530c.exe 1548 a0b53d45cbda284994b819c8cd10530c.exe 1548 a0b53d45cbda284994b819c8cd10530c.exe 1548 a0b53d45cbda284994b819c8cd10530c.exe 1548 a0b53d45cbda284994b819c8cd10530c.exe 1548 a0b53d45cbda284994b819c8cd10530c.exe 1548 a0b53d45cbda284994b819c8cd10530c.exe 1548 a0b53d45cbda284994b819c8cd10530c.exe 1548 a0b53d45cbda284994b819c8cd10530c.exe 1548 a0b53d45cbda284994b819c8cd10530c.exe 1548 a0b53d45cbda284994b819c8cd10530c.exe 1548 a0b53d45cbda284994b819c8cd10530c.exe 1548 a0b53d45cbda284994b819c8cd10530c.exe 1548 a0b53d45cbda284994b819c8cd10530c.exe 1548 a0b53d45cbda284994b819c8cd10530c.exe 1548 a0b53d45cbda284994b819c8cd10530c.exe 1548 a0b53d45cbda284994b819c8cd10530c.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1792 a0b53d45cbda284994b819c8cd10530c.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1792 a0b53d45cbda284994b819c8cd10530c.exe Token: SeDebugPrivilege 1548 a0b53d45cbda284994b819c8cd10530c.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1792 a0b53d45cbda284994b819c8cd10530c.exe 1792 a0b53d45cbda284994b819c8cd10530c.exe 1548 a0b53d45cbda284994b819c8cd10530c.exe 1548 a0b53d45cbda284994b819c8cd10530c.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1792 wrote to memory of 1548 1792 a0b53d45cbda284994b819c8cd10530c.exe 88 PID 1792 wrote to memory of 1548 1792 a0b53d45cbda284994b819c8cd10530c.exe 88 PID 1792 wrote to memory of 1548 1792 a0b53d45cbda284994b819c8cd10530c.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0b53d45cbda284994b819c8cd10530c.exe"C:\Users\Admin\AppData\Local\Temp\a0b53d45cbda284994b819c8cd10530c.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\a0b53d45cbda284994b819c8cd10530c.exeC:\Users\Admin\AppData\Local\Temp\a0b53d45cbda284994b819c8cd10530c.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1548
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD594f14bf026de0a27c1a56624298f7310
SHA1681bfb7105f7cc1163131358a3bc289f0d16ea4f
SHA25622b0e5b56925d17eeb7b7dc0026d2cca624942edfef202f07bc61b8940403423
SHA5122aba8b72183cb58d78002760aa80a05ab4b6e03dc9df632a7f869ff4b61301e038552efcfb39aa911d5a06d498956dfb4decf6f16c1c84910e9c66fd92218f45
-
Filesize
2.4MB
MD5acf7713088657e49bea9c77f814744b9
SHA1f5f858c50822fa8ac2322ae5e92fceeec0fe901d
SHA2567231ca18330485ca2c5cf0008641c685fce4662106b3a4ff29554f897075069e
SHA51254a6ef76b73905c01525962e57dc99cf02844c44b22b4c2f7f478b2edbc947f2e6dbd008e04bc83f30ec9c5ce0ad9c631d9b84d12773d070bd3443d32dcab2ff