Overview
overview
10Static
static
10IDA Pro 7....te.exe
windows10-2004-x64
1IDA Pro 7....64.exe
windows10-2004-x64
1IDA Pro 7.6/ida.exe
windows10-2004-x64
1IDA Pro 7.6/ida64.exe
windows10-2004-x64
1IDA Pro 7....ch.exe
windows10-2004-x64
1IDA Pro 7.6/idat.exe
windows10-2004-x64
1IDA Pro 7....64.exe
windows10-2004-x64
1IDA Pro 7....ph.exe
windows10-2004-x64
1IDA Pro 7....ll.exe
windows10-2004-x64
8Analysis
-
max time kernel
29s -
max time network
90s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-09-2022 14:00
Behavioral task
behavioral1
Sample
IDA Pro 7.6/dbgsrv/win32_remote.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral2
Sample
IDA Pro 7.6/dbgsrv/win64_remote64.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
IDA Pro 7.6/ida.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral4
Sample
IDA Pro 7.6/ida64.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
IDA Pro 7.6/idapyswitch.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral6
Sample
IDA Pro 7.6/idat.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
IDA Pro 7.6/idat64.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral8
Sample
IDA Pro 7.6/qwingraph.exe
Resource
win10v2004-20220812-en
General
-
Target
IDA Pro 7.6/ida64.exe
-
Size
4.1MB
-
MD5
66eabd95013d3102f79953db2cd39c59
-
SHA1
2e56467fc0bf87cf358feee13991e068c06aecf5
-
SHA256
05379216c29ad2b43e6a0287c8d45d448abba50ebc1847400004d71515f01be5
-
SHA512
b2adf6a7887538fe02532467951897fa3a4b4750c574aca169203518de895173b44475c88c7464968c29240bfbda2043bde9a8c553c2eefd92aa6e5aec20f5c9
-
SSDEEP
49152:baK0aVnZcqdnxKsxA8V7FjfZXEDsf449f1zvLMi/gxT9lcoaM0ImZ9eo/H/LAi61:9cqGszpYs9NCwZeKm
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
ida64.exepid process 1576 ida64.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
ida64.exepid process 1576 ida64.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ida64.exepid process 1576 ida64.exe