Analysis

  • max time kernel
    151s
  • max time network
    198s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220721-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-07-2022 06:22

General

  • Target

    04a1801226588a5dc85429674f3bdf7a798f31aa37ef1a16fff39b48c525808f.exe

  • Size

    3.1MB

  • MD5

    855df0d3ecae8faf5e984b52ea213e13

  • SHA1

    95678c3bc95add7b3e80f0f7fd2c4296f6feaaf9

  • SHA256

    04a1801226588a5dc85429674f3bdf7a798f31aa37ef1a16fff39b48c525808f

  • SHA512

    4c8184391668f671916c4046cbd78dde6dc2d8b4708c91e4eae05c9f4fcc81102c72e2f00fce894987a3d7bffb0c341ad130a6b052726021c766f665109a8705

Malware Config

Signatures

  • joker

    Joker is an Android malware that targets billing and SMS fraud.

  • UPX packed file 23 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\04a1801226588a5dc85429674f3bdf7a798f31aa37ef1a16fff39b48c525808f.exe
    "C:\Users\Admin\AppData\Local\Temp\04a1801226588a5dc85429674f3bdf7a798f31aa37ef1a16fff39b48c525808f.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\speedhack-i386.dll

    Filesize

    177KB

    MD5

    f581898b2ff51c2ccca11993b693c628

    SHA1

    f3477f50a088579c7d132e7846848b4196b4f488

    SHA256

    4f612169a241a06e8a910fe2ecad6190e0958da0128d29b335064e68611aa26f

    SHA512

    08bb46a2cbcf8afd4222f57cc92cf10defb2639e850b7043cb3ccf5f67546567069004e31205ae9f8c52fe9816a3c6963b96b946121fc500c89925246de43294

  • C:\Users\Admin\AppData\Local\Temp\speedhack-i386.dll

    Filesize

    177KB

    MD5

    f581898b2ff51c2ccca11993b693c628

    SHA1

    f3477f50a088579c7d132e7846848b4196b4f488

    SHA256

    4f612169a241a06e8a910fe2ecad6190e0958da0128d29b335064e68611aa26f

    SHA512

    08bb46a2cbcf8afd4222f57cc92cf10defb2639e850b7043cb3ccf5f67546567069004e31205ae9f8c52fe9816a3c6963b96b946121fc500c89925246de43294

  • memory/528-152-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/528-134-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/528-136-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/528-138-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/528-140-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/528-144-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/528-142-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/528-146-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/528-148-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/528-150-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/528-132-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/528-131-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/528-160-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/528-154-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/528-158-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/528-164-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/528-162-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/528-166-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/528-168-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/528-170-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/528-172-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/528-156-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/528-175-0x00000000053B0000-0x00000000053E2000-memory.dmp

    Filesize

    200KB

  • memory/528-130-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB