Analysis
-
max time kernel
158s -
max time network
175s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/03/2024, 20:21
Static task
static1
Behavioral task
behavioral1
Sample
630ac479dedd0871d0ddab0413c56a3c8da26a3047f983ad62494861db730b36.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
630ac479dedd0871d0ddab0413c56a3c8da26a3047f983ad62494861db730b36.exe
Resource
win10v2004-20240226-en
General
-
Target
630ac479dedd0871d0ddab0413c56a3c8da26a3047f983ad62494861db730b36.exe
-
Size
5.8MB
-
MD5
90105e3e63a2593029d65a8a6014383f
-
SHA1
eec7d0d8e711af7595ca612a3ffa57261b4495ef
-
SHA256
630ac479dedd0871d0ddab0413c56a3c8da26a3047f983ad62494861db730b36
-
SHA512
6032bf3782ae91f1d21ac0892480350dd83d6cf2d7c2b5de3cbf9dd915bedaf68736b378921eaba46a59bb4e7d0f365523c6382707112f4c0e461df6b3923a2c
-
SSDEEP
98304:sMuTbzoAF5cDXgSYEKACrghsIffPuCAsXf2fYDgKfEJDyPmqlG:sMuJ+JlCkhsIHvXXfjfk+Pmo
Malware Config
Signatures
-
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 162.246.18.167 Destination IP 162.246.18.167 Destination IP 162.246.18.167 -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3008 630ac479dedd0871d0ddab0413c56a3c8da26a3047f983ad62494861db730b36.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3008 630ac479dedd0871d0ddab0413c56a3c8da26a3047f983ad62494861db730b36.exe 3008 630ac479dedd0871d0ddab0413c56a3c8da26a3047f983ad62494861db730b36.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3008 630ac479dedd0871d0ddab0413c56a3c8da26a3047f983ad62494861db730b36.exe 3008 630ac479dedd0871d0ddab0413c56a3c8da26a3047f983ad62494861db730b36.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\630ac479dedd0871d0ddab0413c56a3c8da26a3047f983ad62494861db730b36.exe"C:\Users\Admin\AppData\Local\Temp\630ac479dedd0871d0ddab0413c56a3c8da26a3047f983ad62494861db730b36.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3008