Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/03/2024, 21:08
Static task
static1
Behavioral task
behavioral1
Sample
8281138010117a9b43b43ba3bfd68ad1d6a88696c3d4a9519c1b3909e1beac66.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8281138010117a9b43b43ba3bfd68ad1d6a88696c3d4a9519c1b3909e1beac66.exe
Resource
win10v2004-20240226-en
General
-
Target
8281138010117a9b43b43ba3bfd68ad1d6a88696c3d4a9519c1b3909e1beac66.exe
-
Size
12.6MB
-
MD5
0457ebc5c7fa05a15e1810172806b64b
-
SHA1
34d7965c6a5da72920c5bdf1f72437e4ba49ffd1
-
SHA256
8281138010117a9b43b43ba3bfd68ad1d6a88696c3d4a9519c1b3909e1beac66
-
SHA512
d52d6608e2580da3fd7d20b9896345e76a7e61fb907d688d44431ef9a97100b452975f9a17bea88d7931a505b8090da595c65ddd2af56655ba864d00de96f555
-
SSDEEP
196608:l8fyzbu74fXyWx+cmno37UYK69X8rDe1q8W9mIFkPfqm0tW3pqTwypl8EOEqD0OS:1za7mXyWx18gX8H4q8W1mKccwynu0OS
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3688 8281138010117a9b43b43ba3bfd68ad1d6a88696c3d4a9519c1b3909e1beac66.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3688 8281138010117a9b43b43ba3bfd68ad1d6a88696c3d4a9519c1b3909e1beac66.exe 3688 8281138010117a9b43b43ba3bfd68ad1d6a88696c3d4a9519c1b3909e1beac66.exe 3688 8281138010117a9b43b43ba3bfd68ad1d6a88696c3d4a9519c1b3909e1beac66.exe 3688 8281138010117a9b43b43ba3bfd68ad1d6a88696c3d4a9519c1b3909e1beac66.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3688 8281138010117a9b43b43ba3bfd68ad1d6a88696c3d4a9519c1b3909e1beac66.exe 3688 8281138010117a9b43b43ba3bfd68ad1d6a88696c3d4a9519c1b3909e1beac66.exe 3688 8281138010117a9b43b43ba3bfd68ad1d6a88696c3d4a9519c1b3909e1beac66.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8281138010117a9b43b43ba3bfd68ad1d6a88696c3d4a9519c1b3909e1beac66.exe"C:\Users\Admin\AppData\Local\Temp\8281138010117a9b43b43ba3bfd68ad1d6a88696c3d4a9519c1b3909e1beac66.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3688