Analysis

  • max time kernel
    898s
  • max time network
    892s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20250113-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    15/01/2025, 22:04

General

  • Target

    ServerHosting.exe

  • Size

    183KB

  • MD5

    eb6a72e187ab08c083fd5d4f34093e95

  • SHA1

    5253a5f60fe7f9188b37041fb725ec84ccc39ffe

  • SHA256

    5ce530ab5407bcd9dd3d8f0381227d62c3e3c0eb64e13ecd55088f5f47bdaf0e

  • SHA512

    99eab46001751ae86c78fbd2d35f1aff1685d86bc2fd9be9d8cc570a2209eed5b2b68d575fa09e33c18e58596645a7a8806bfc20083355080dea97c0f37c1d59

  • SSDEEP

    3072:HurlxKcWiZde2vBVQF4EWjFRA229YvepcCBKX4pn:OrluwdeAVQF4EWx92iepcCBKo

Malware Config

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\ServerHosting.exe
    "C:\Users\Admin\AppData\Local\Temp\ServerHosting.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:5092

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/5092-0-0x00007FFDD2015000-0x00007FFDD2016000-memory.dmp

          Filesize

          4KB

        • memory/5092-1-0x000000001B8A0000-0x000000001B946000-memory.dmp

          Filesize

          664KB

        • memory/5092-2-0x00007FFDD1D60000-0x00007FFDD2701000-memory.dmp

          Filesize

          9.6MB

        • memory/5092-3-0x000000001BE90000-0x000000001C35E000-memory.dmp

          Filesize

          4.8MB

        • memory/5092-4-0x000000001C420000-0x000000001C4BC000-memory.dmp

          Filesize

          624KB

        • memory/5092-5-0x00007FFDD1D60000-0x00007FFDD2701000-memory.dmp

          Filesize

          9.6MB

        • memory/5092-6-0x00000000012C0000-0x00000000012C8000-memory.dmp

          Filesize

          32KB

        • memory/5092-7-0x000000001C580000-0x000000001C5CC000-memory.dmp

          Filesize

          304KB

        • memory/5092-8-0x000000001F210000-0x000000001F520000-memory.dmp

          Filesize

          3.1MB

        • memory/5092-9-0x00007FFDD1D60000-0x00007FFDD2701000-memory.dmp

          Filesize

          9.6MB

        • memory/5092-10-0x00007FFDD2015000-0x00007FFDD2016000-memory.dmp

          Filesize

          4KB

        • memory/5092-11-0x00007FFDD1D60000-0x00007FFDD2701000-memory.dmp

          Filesize

          9.6MB

        • memory/5092-12-0x00007FFDD1D60000-0x00007FFDD2701000-memory.dmp

          Filesize

          9.6MB

        • memory/5092-13-0x00007FFDD1D60000-0x00007FFDD2701000-memory.dmp

          Filesize

          9.6MB