Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 12:54
Static task
static1
Behavioral task
behavioral1
Sample
793f2ab70018ae21eefe1edf57f2bec4f603580321609127003cdce55a73b2b5.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
793f2ab70018ae21eefe1edf57f2bec4f603580321609127003cdce55a73b2b5.exe
Resource
win10v2004-20240508-en
General
-
Target
793f2ab70018ae21eefe1edf57f2bec4f603580321609127003cdce55a73b2b5.exe
-
Size
9.2MB
-
MD5
c3639315e9c2da5c398e762fb36e0a4c
-
SHA1
8e797f6a592336a47234215f08f590e20da1cacb
-
SHA256
793f2ab70018ae21eefe1edf57f2bec4f603580321609127003cdce55a73b2b5
-
SHA512
3ccaf68b7638a55f11e596ca37057bc6f7bd5667a5387825d822c1bfcf2cae3a8e4ffa97f82741d306eb8b23e1da95d88ed75ee952fcb4a413f95b716fabc044
-
SSDEEP
196608:oW+7p2GtkGjOtwzF4CmYfmS5RiebIYV9KKMAa8n+ocC6g6v66666ES66666E6kD7:v+7prWWC1S1xV9EAh+ocC6g6v66666ES
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1928 793f2ab70018ae21eefe1edf57f2bec4f603580321609127003cdce55a73b2b5.exe 1928 793f2ab70018ae21eefe1edf57f2bec4f603580321609127003cdce55a73b2b5.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1928 793f2ab70018ae21eefe1edf57f2bec4f603580321609127003cdce55a73b2b5.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1928 793f2ab70018ae21eefe1edf57f2bec4f603580321609127003cdce55a73b2b5.exe 1928 793f2ab70018ae21eefe1edf57f2bec4f603580321609127003cdce55a73b2b5.exe 1928 793f2ab70018ae21eefe1edf57f2bec4f603580321609127003cdce55a73b2b5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\793f2ab70018ae21eefe1edf57f2bec4f603580321609127003cdce55a73b2b5.exe"C:\Users\Admin\AppData\Local\Temp\793f2ab70018ae21eefe1edf57f2bec4f603580321609127003cdce55a73b2b5.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1928