Analysis

  • max time kernel
    123s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/10/2022, 07:14

General

  • Target

    22208608c0d54a9240046258e16f012fb0621cc5a2c8e232be5fbec209594061.exe

  • Size

    92KB

  • MD5

    66141ebd678cecf40020b5f36b523c05

  • SHA1

    7cb3c7c9758e72ca07eed0a072c24045e0ef0118

  • SHA256

    22208608c0d54a9240046258e16f012fb0621cc5a2c8e232be5fbec209594061

  • SHA512

    289886048da98c1dc957599fe2e40f2d94c873f4c91e0afa0f95af8b9af7b44cc561fb42dc2d60d42c438278c14853a87b0815f79f276cf921cbf635f1ec7921

  • SSDEEP

    1536:UtxwjjK7lp27GjV3P1YIl3oyzrmgrZ0kqfrC3Y9TDr6Ot+kXsNwv:Eqjm7l4yzr91jqTCI9Tpt+kXOwv

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 3 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\22208608c0d54a9240046258e16f012fb0621cc5a2c8e232be5fbec209594061.exe
    "C:\Users\Admin\AppData\Local\Temp\22208608c0d54a9240046258e16f012fb0621cc5a2c8e232be5fbec209594061.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    PID:5048
  • C:\Windows\SysWOW64\stwbjl.exe
    C:\Windows\SysWOW64\stwbjl.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    PID:1476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\hra33.dll

    Filesize

    100KB

    MD5

    59609d8c086c4a04a912bb66d57df870

    SHA1

    24ef3c29e278d81155f9e4f4903d846195432315

    SHA256

    c6926ec99bd7f77884c9d87f67b0535384ab70456c8a6670243bf5110120657d

    SHA512

    6131b7c0dd1c79bf7cead0d1a528d6bfe2c88b8b9f8291c39b8dcdbecd9e0c3040585cfbdd70dd09fbb7e24517660f8a3afe379b6d51b4f27f8e0f636a975f3a

  • C:\Windows\SysWOW64\stwbjl.exe

    Filesize

    92KB

    MD5

    66141ebd678cecf40020b5f36b523c05

    SHA1

    7cb3c7c9758e72ca07eed0a072c24045e0ef0118

    SHA256

    22208608c0d54a9240046258e16f012fb0621cc5a2c8e232be5fbec209594061

    SHA512

    289886048da98c1dc957599fe2e40f2d94c873f4c91e0afa0f95af8b9af7b44cc561fb42dc2d60d42c438278c14853a87b0815f79f276cf921cbf635f1ec7921

  • C:\Windows\SysWOW64\stwbjl.exe

    Filesize

    92KB

    MD5

    66141ebd678cecf40020b5f36b523c05

    SHA1

    7cb3c7c9758e72ca07eed0a072c24045e0ef0118

    SHA256

    22208608c0d54a9240046258e16f012fb0621cc5a2c8e232be5fbec209594061

    SHA512

    289886048da98c1dc957599fe2e40f2d94c873f4c91e0afa0f95af8b9af7b44cc561fb42dc2d60d42c438278c14853a87b0815f79f276cf921cbf635f1ec7921

  • memory/1476-135-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

  • memory/1476-137-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

  • memory/5048-134-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB