Analysis
-
max time kernel
137s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28-12-2024 00:55
Behavioral task
behavioral1
Sample
8.3/IDA_Pro_8.3.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
8.3/IDA_Pro_8.3.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
8.3/ida.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
8.3/ida.exe
Resource
win10v2004-20241007-en
General
-
Target
8.3/ida.exe
-
Size
4.0MB
-
MD5
3cdc0264ed608032a128b0d378dc1735
-
SHA1
4af272bbb78dea037b6f97a176afa5d0bff3b356
-
SHA256
eb6349d53c8f8e4f1b649369d5435694141638fc088810e2e138b691b2db9dba
-
SHA512
fb3b330965091ab1f11d29b5228bf9ce52269ce4a23c0e7937d2cb76ac40437e2da7ec539827e47f1ebda75b0ed0c17154987b0bee6a1cedf1b0e020581f4db0
-
SSDEEP
49152:5YPnm/Zi34DKYj0ZkO4+XTcSq8EQtezdGfPko7FjOeBfDMmpwfFcnQOh6H6RBvV9:5wmOqjcXA0nexReBv6avGBXMi+7Wg
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2832 ida.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 528 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 528 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2832 ida.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8.3\ida.exe"C:\Users\Admin\AppData\Local\Temp\8.3\ida.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2832
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f8 0x3ec1⤵
- Suspicious use of AdjustPrivilegeToken
PID:528