Resubmissions
17/11/2024, 20:54
241117-zp1hfsycjm 7Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
-
submitted
17/11/2024, 20:54
General
-
Target
Felk/Felk.exe
-
Size
1.4MB
-
MD5
6048db38aa4a61979ee56fdfa2ac4632
-
SHA1
9258a870a19c48feedb09d653b05f2417fd39cef
-
SHA256
45b11b72851723dc55ad244d58563d8024dbcb67dc61734776545043a6786492
-
SHA512
903f98b4cc4ab9290b1c8527713d50524abc424198822ec1737c9fa6ce4766d9a96f182ea24005c76ec53e12a0bee75aa137532dc02d2389df6a6358aa144b40
-
SSDEEP
12288:2CsmKysMAMhMTMVxu2LCMVxuiMVxuiMVxuhg+lE3MmM:2fMAMhM4xKKggqE3MmM
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Felk\Felk.exe"C:\Users\Admin\AppData\Local\Temp\Felk\Felk.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
142KB
MD59c43f77cb7cff27cb47ed67babe3eda5
SHA1b0400cf68249369d21de86bd26bb84ccffd47c43
SHA256f25b9288fe370dcfcb4823fb4e44ab88c7f5fce6e137d0dba389a3dba07d621e
SHA512cde6fb6cf8db6f9746e69e6c10214e60b3646700d70b49668a2a792e309714dd2d4c5a5241977a833a95fcde8318abcc89eb9968a5039a0b75726bbfa27125a7
-
Filesize
352KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
156KB
-
Filesize
368KB
-
Filesize
1.3MB
-
Filesize
1.4MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
2.3MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
32KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
156KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
7.4MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB