Analysis
-
max time kernel
135s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
01-08-2024 22:58
Behavioral task
behavioral1
Sample
HadesKey SE.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
HadesKey SE.exe
Resource
win10v2004-20240730-en
Behavioral task
behavioral3
Sample
HadèsKey - Logs Decrypt.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
HadèsKey - Logs Decrypt.exe
Resource
win10v2004-20240730-en
Behavioral task
behavioral5
Sample
ReActiveMe.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
ReActiveMe.exe
Resource
win10v2004-20240730-en
Behavioral task
behavioral7
Sample
Stub.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
Stub.exe
Resource
win10v2004-20240730-en
General
-
Target
HadesKey SE.exe
-
Size
769KB
-
MD5
6e2475120c6b8897a62f93bf3f757d9f
-
SHA1
f2cab685014834e81a7baa4338bd0b2ed910ecd2
-
SHA256
046bf49f118e290386fa713b90eed77b14be0e3c519f5e54c8facb928cde8272
-
SHA512
1d105542fb5ffe3dc764f676f53cfd436e66a747a787f1a4399ee86f67ef4b803c50673c8df0e5f970463159e1e54c0c1e5e70b0b142915d76204e35db155535
-
SSDEEP
12288:sGL0MnO+zd9sNVz/TmUpNMdbU5NpS5R+V63EWD/DnTAWtC5UVwV:VYMnjPsNBKmpS5R+V6UWDDTDtC
Malware Config
Signatures
-
Drops desktop.ini file(s) 2 IoCs
Processes:
HadesKey SE.exedescription ioc process File created C:\Windows\assembly\Desktop.ini HadesKey SE.exe File opened for modification C:\Windows\assembly\Desktop.ini HadesKey SE.exe -
Drops file in Windows directory 3 IoCs
Processes:
HadesKey SE.exedescription ioc process File opened for modification C:\Windows\assembly HadesKey SE.exe File created C:\Windows\assembly\Desktop.ini HadesKey SE.exe File opened for modification C:\Windows\assembly\Desktop.ini HadesKey SE.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
HadesKey SE.exedescription pid process Token: SeDebugPrivilege 2684 HadesKey SE.exe Token: 33 2684 HadesKey SE.exe Token: SeIncBasePriorityPrivilege 2684 HadesKey SE.exe