Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 13:30
Static task
static1
Behavioral task
behavioral1
Sample
1758a3b529c8fb1a968466d86669eaac722da244bf94487500d21802ff80b62b.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1758a3b529c8fb1a968466d86669eaac722da244bf94487500d21802ff80b62b.exe
Resource
win10v2004-20240426-en
General
-
Target
1758a3b529c8fb1a968466d86669eaac722da244bf94487500d21802ff80b62b.exe
-
Size
3.7MB
-
MD5
f578f3c48c584418d869739356c47cc2
-
SHA1
74e8f05d0c0e5ee926178d913f64ae32ab892841
-
SHA256
1758a3b529c8fb1a968466d86669eaac722da244bf94487500d21802ff80b62b
-
SHA512
7b57fea3dbf39bbe7f48ad42b6d250c825b4a456053a45e15c26a6bc7f7d29e52d26c14dd67bd67b441baa7c65694f1baccbd312e1c48ba287f8776aa27dff1b
-
SSDEEP
98304:spyKjW7Iu/OGwrAVg8xRYph1RFP94SrbYmz6iMSLh99:4kj/7OAVg8cr1HVTGJQ
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 3192 1758a3b529c8fb1a968466d86669eaac722da244bf94487500d21802ff80b62b.exe 3192 1758a3b529c8fb1a968466d86669eaac722da244bf94487500d21802ff80b62b.exe 3192 1758a3b529c8fb1a968466d86669eaac722da244bf94487500d21802ff80b62b.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3192 1758a3b529c8fb1a968466d86669eaac722da244bf94487500d21802ff80b62b.exe Token: SeDebugPrivilege 3192 1758a3b529c8fb1a968466d86669eaac722da244bf94487500d21802ff80b62b.exe Token: SeDebugPrivilege 3192 1758a3b529c8fb1a968466d86669eaac722da244bf94487500d21802ff80b62b.exe Token: SeDebugPrivilege 3192 1758a3b529c8fb1a968466d86669eaac722da244bf94487500d21802ff80b62b.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3192 1758a3b529c8fb1a968466d86669eaac722da244bf94487500d21802ff80b62b.exe 3192 1758a3b529c8fb1a968466d86669eaac722da244bf94487500d21802ff80b62b.exe 3192 1758a3b529c8fb1a968466d86669eaac722da244bf94487500d21802ff80b62b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1758a3b529c8fb1a968466d86669eaac722da244bf94487500d21802ff80b62b.exe"C:\Users\Admin\AppData\Local\Temp\1758a3b529c8fb1a968466d86669eaac722da244bf94487500d21802ff80b62b.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3192