Overview
overview
7Static
static
702396c8d0b...a5.exe
windows7-x64
702396c8d0b...a5.exe
windows10-2004-x64
73fe0c0ed2c...d3.exe
windows7-x64
73fe0c0ed2c...d3.exe
windows10-2004-x64
7a1be538f4b...20.exe
windows7-x64
1a1be538f4b...20.exe
windows10-2004-x64
1aaa70c51d1...c1.exe
windows7-x64
1aaa70c51d1...c1.exe
windows10-2004-x64
1c08bd0d437...2c.exe
windows7-x64
7c08bd0d437...2c.exe
windows10-2004-x64
5e6a7f5cc7c...e5.exe
windows7-x64
1e6a7f5cc7c...e5.exe
windows10-2004-x64
1fc5a6fa814...e0.exe
windows7-x64
5fc5a6fa814...e0.exe
windows10-2004-x64
5Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/04/2024, 13:49
Behavioral task
behavioral1
Sample
02396c8d0ba705e42e0a4f1a7b8e151c5093910346746546104d88e81e7e22a5.exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral2
Sample
02396c8d0ba705e42e0a4f1a7b8e151c5093910346746546104d88e81e7e22a5.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
3fe0c0ed2cd4ebd556ba5af53d782796a7064a3cb2eb8759d87722c0b417afd3.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
3fe0c0ed2cd4ebd556ba5af53d782796a7064a3cb2eb8759d87722c0b417afd3.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
a1be538f4beada0a6fafe201707e8e76cb67ac9f303def2a0e515ef687c2b220.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
a1be538f4beada0a6fafe201707e8e76cb67ac9f303def2a0e515ef687c2b220.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
aaa70c51d115bfe403c7bdfe7f9c7bcec44ba26854d8921f8d599ada8dd270c1.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
aaa70c51d115bfe403c7bdfe7f9c7bcec44ba26854d8921f8d599ada8dd270c1.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
c08bd0d4371509ff105c0988e2dec26c483df4a8ed2998715a90dd273fd2662c.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral10
Sample
c08bd0d4371509ff105c0988e2dec26c483df4a8ed2998715a90dd273fd2662c.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
e6a7f5cc7c08e6150cadf8764b03e658e7a1cf53b06e240406703df1d50d06e5.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral12
Sample
e6a7f5cc7c08e6150cadf8764b03e658e7a1cf53b06e240406703df1d50d06e5.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe
Resource
win7-20240319-en
windows7-x64
Behavioral task
behavioral14
Sample
fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
General
-
Target
fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe
-
Size
3.0MB
-
MD5
1f1b5c776eeafbce36a7feafc20c4cb5
-
SHA1
8584af079c7d57f8f5c51b1737cc3ef91ab747d7
-
SHA256
fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0
-
SHA512
ca6b4ab8440254196ef7345243aefe88fb6b274623f201d53730dd6795f654a114fa4a42eae4566383d2232d6393f47cfb9ba802f05db812d292d2ea1edf51c3
-
SSDEEP
49152:2hn9BTD9dfTTk+xYcymNryJW2t3pYjpfO98tUChoQ0f:2h9BwVchNrytpkFW
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 3748 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe 3748 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: 1 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeCreateTokenPrivilege 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeAssignPrimaryTokenPrivilege 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeLockMemoryPrivilege 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeIncreaseQuotaPrivilege 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeMachineAccountPrivilege 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeTcbPrivilege 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeSecurityPrivilege 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeTakeOwnershipPrivilege 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeLoadDriverPrivilege 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeSystemProfilePrivilege 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeSystemtimePrivilege 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeProfSingleProcessPrivilege 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeIncBasePriorityPrivilege 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeCreatePagefilePrivilege 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeCreatePermanentPrivilege 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeBackupPrivilege 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeRestorePrivilege 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeShutdownPrivilege 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeDebugPrivilege 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeAuditPrivilege 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeSystemEnvironmentPrivilege 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeChangeNotifyPrivilege 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeRemoteShutdownPrivilege 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeUndockPrivilege 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeSyncAgentPrivilege 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeEnableDelegationPrivilege 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeManageVolumePrivilege 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeImpersonatePrivilege 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeCreateGlobalPrivilege 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: 31 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: 32 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: 33 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: 34 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: 35 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: 36 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: 37 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: 38 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: 39 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: 40 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: 41 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: 42 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: 43 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: 44 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: 45 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: 46 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: 47 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: 48 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeDebugPrivilege 3748 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: 1 3748 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeCreateTokenPrivilege 3748 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeAssignPrimaryTokenPrivilege 3748 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeLockMemoryPrivilege 3748 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeIncreaseQuotaPrivilege 3748 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeMachineAccountPrivilege 3748 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeTcbPrivilege 3748 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeSecurityPrivilege 3748 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeTakeOwnershipPrivilege 3748 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeLoadDriverPrivilege 3748 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeSystemProfilePrivilege 3748 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeSystemtimePrivilege 3748 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeProfSingleProcessPrivilege 3748 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe Token: SeIncBasePriorityPrivilege 3748 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe 3748 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe 3748 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1604 wrote to memory of 3748 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe 89 PID 1604 wrote to memory of 3748 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe 89 PID 1604 wrote to memory of 3748 1604 fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe"C:\Users\Admin\AppData\Local\Temp\fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe"C:\Users\Admin\AppData\Local\Temp\fc5a6fa814dbc5e41f844b511c9c83ec5a576fc14ef92ac7925b6b56940a40e0.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3748
-