Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29-02-2024 09:46
Behavioral task
behavioral1
Sample
f4088e6672ab5c67475864cd429734c4693269b72377f06a3f55a48b333390cc.exe
Resource
win7-20240220-en
General
-
Target
f4088e6672ab5c67475864cd429734c4693269b72377f06a3f55a48b333390cc.exe
-
Size
3.8MB
-
MD5
597c03ec993d20052e1d0a9d5853ce5b
-
SHA1
9465c11cdcb81d0943376ae43b9dd77c515c8f01
-
SHA256
f4088e6672ab5c67475864cd429734c4693269b72377f06a3f55a48b333390cc
-
SHA512
34bac5acbc0044acb77da9ad215c7351883914f3a3914f4945b05c7899d22f0321f7fdaed0920d546e3cfdcac9c386228dce8b53f7d4be8324fba909000c366d
-
SSDEEP
49152:zXUIEeZzdeh/c7p1rNdd+JNEj0ykdj21x1YhFlX4bA/Hg/11VzeLG/7wqNKB2VIb:zXrEeZzdhjuV/gd1VzsGUqNKTHvQey6
Malware Config
Extracted
bitrat
1.35
yatzufn.ddns.net:1900
-
communication_password
202cb962ac59075b964b07152d234b70
-
tor_process
tor
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
f4088e6672ab5c67475864cd429734c4693269b72377f06a3f55a48b333390cc.exepid process 1576 f4088e6672ab5c67475864cd429734c4693269b72377f06a3f55a48b333390cc.exe 1576 f4088e6672ab5c67475864cd429734c4693269b72377f06a3f55a48b333390cc.exe 1576 f4088e6672ab5c67475864cd429734c4693269b72377f06a3f55a48b333390cc.exe 1576 f4088e6672ab5c67475864cd429734c4693269b72377f06a3f55a48b333390cc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
f4088e6672ab5c67475864cd429734c4693269b72377f06a3f55a48b333390cc.exedescription pid process Token: SeShutdownPrivilege 1576 f4088e6672ab5c67475864cd429734c4693269b72377f06a3f55a48b333390cc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
f4088e6672ab5c67475864cd429734c4693269b72377f06a3f55a48b333390cc.exepid process 1576 f4088e6672ab5c67475864cd429734c4693269b72377f06a3f55a48b333390cc.exe 1576 f4088e6672ab5c67475864cd429734c4693269b72377f06a3f55a48b333390cc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4088e6672ab5c67475864cd429734c4693269b72377f06a3f55a48b333390cc.exe"C:\Users\Admin\AppData\Local\Temp\f4088e6672ab5c67475864cd429734c4693269b72377f06a3f55a48b333390cc.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1576-0-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1576-1-0x0000000074770000-0x00000000747A9000-memory.dmpFilesize
228KB
-
memory/1576-2-0x0000000074B70000-0x0000000074BA9000-memory.dmpFilesize
228KB
-
memory/1576-3-0x0000000074B70000-0x0000000074BA9000-memory.dmpFilesize
228KB
-
memory/1576-13-0x0000000074B70000-0x0000000074BA9000-memory.dmpFilesize
228KB
-
memory/1576-14-0x0000000074B70000-0x0000000074BA9000-memory.dmpFilesize
228KB
-
memory/1576-15-0x0000000074B70000-0x0000000074BA9000-memory.dmpFilesize
228KB
-
memory/1576-16-0x0000000074B70000-0x0000000074BA9000-memory.dmpFilesize
228KB
-
memory/1576-17-0x0000000074B70000-0x0000000074BA9000-memory.dmpFilesize
228KB
-
memory/1576-18-0x0000000074B70000-0x0000000074BA9000-memory.dmpFilesize
228KB
-
memory/1576-19-0x0000000074B70000-0x0000000074BA9000-memory.dmpFilesize
228KB
-
memory/1576-20-0x0000000074B70000-0x0000000074BA9000-memory.dmpFilesize
228KB
-
memory/1576-29-0x0000000074B70000-0x0000000074BA9000-memory.dmpFilesize
228KB