Analysis
-
max time kernel
142s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 06:22
Static task
static1
Behavioral task
behavioral1
Sample
f70f770d366cdef6f4ffc35f8c595fc5e4308354d820b456f1d4a65da8451e93.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f70f770d366cdef6f4ffc35f8c595fc5e4308354d820b456f1d4a65da8451e93.exe
Resource
win10v2004-20240508-en
General
-
Target
f70f770d366cdef6f4ffc35f8c595fc5e4308354d820b456f1d4a65da8451e93.exe
-
Size
10.4MB
-
MD5
4f6ccde10891fb14eff91ae0465bbfb5
-
SHA1
5e47ad198325ece256a506b7130d9cd9f1ef35fa
-
SHA256
f70f770d366cdef6f4ffc35f8c595fc5e4308354d820b456f1d4a65da8451e93
-
SHA512
806a27bd8e60929ab8142fcf1f0c980e9da3fd62e3a76fe913fd6973eacd23bb7a6fa196ccb1953175d78976daaad63e7906603cb2a6bdd78c3d2fa9713d586b
-
SSDEEP
196608:0ys8eY9uS+dFrXN42CmQSawWWPVOzbJQoG4t0gtw:0yr9uSOr9dCmQAO3tG4tp
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 5064 f70f770d366cdef6f4ffc35f8c595fc5e4308354d820b456f1d4a65da8451e93.exe 5064 f70f770d366cdef6f4ffc35f8c595fc5e4308354d820b456f1d4a65da8451e93.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5064 f70f770d366cdef6f4ffc35f8c595fc5e4308354d820b456f1d4a65da8451e93.exe 5064 f70f770d366cdef6f4ffc35f8c595fc5e4308354d820b456f1d4a65da8451e93.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 5064 f70f770d366cdef6f4ffc35f8c595fc5e4308354d820b456f1d4a65da8451e93.exe 5064 f70f770d366cdef6f4ffc35f8c595fc5e4308354d820b456f1d4a65da8451e93.exe 5064 f70f770d366cdef6f4ffc35f8c595fc5e4308354d820b456f1d4a65da8451e93.exe 5064 f70f770d366cdef6f4ffc35f8c595fc5e4308354d820b456f1d4a65da8451e93.exe 5064 f70f770d366cdef6f4ffc35f8c595fc5e4308354d820b456f1d4a65da8451e93.exe 5064 f70f770d366cdef6f4ffc35f8c595fc5e4308354d820b456f1d4a65da8451e93.exe 5064 f70f770d366cdef6f4ffc35f8c595fc5e4308354d820b456f1d4a65da8451e93.exe 5064 f70f770d366cdef6f4ffc35f8c595fc5e4308354d820b456f1d4a65da8451e93.exe 5064 f70f770d366cdef6f4ffc35f8c595fc5e4308354d820b456f1d4a65da8451e93.exe 5064 f70f770d366cdef6f4ffc35f8c595fc5e4308354d820b456f1d4a65da8451e93.exe 5064 f70f770d366cdef6f4ffc35f8c595fc5e4308354d820b456f1d4a65da8451e93.exe 5064 f70f770d366cdef6f4ffc35f8c595fc5e4308354d820b456f1d4a65da8451e93.exe 5064 f70f770d366cdef6f4ffc35f8c595fc5e4308354d820b456f1d4a65da8451e93.exe 5064 f70f770d366cdef6f4ffc35f8c595fc5e4308354d820b456f1d4a65da8451e93.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f70f770d366cdef6f4ffc35f8c595fc5e4308354d820b456f1d4a65da8451e93.exe"C:\Users\Admin\AppData\Local\Temp\f70f770d366cdef6f4ffc35f8c595fc5e4308354d820b456f1d4a65da8451e93.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5064