Analysis
-
max time kernel
102s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2022 18:36
Static task
static1
Behavioral task
behavioral1
Sample
0f4cde4fb7d3c9686dbb0300761d42bf074567719c1f0330adcaebd564730a61.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0f4cde4fb7d3c9686dbb0300761d42bf074567719c1f0330adcaebd564730a61.exe
Resource
win10v2004-20220901-en
General
-
Target
0f4cde4fb7d3c9686dbb0300761d42bf074567719c1f0330adcaebd564730a61.exe
-
Size
56KB
-
MD5
6cd46b448444588e20ddc251e3348460
-
SHA1
2f112ba5fb9a6dd89370ca49f82e7ce108f86f3d
-
SHA256
0f4cde4fb7d3c9686dbb0300761d42bf074567719c1f0330adcaebd564730a61
-
SHA512
636db1e7c847d18c5c0e373373af94f76ae44fb7c9c6aeef6ecdfe5af50e674fdbf216dc4ffe1242c4f67a3844b52b6a77f12f8113c5eab95b22305a2bfae53e
-
SSDEEP
1536:r5wa+WzILBZyrowDL0p2UYPuyOLO0+M9bvI:rpk/yrowsUUYPxqJw
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 4596 0f4cde4fb7d3c9686dbb0300761d42bf074567719c1f0330adcaebd564730a61.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\vcmgcd32.dl_ 0f4cde4fb7d3c9686dbb0300761d42bf074567719c1f0330adcaebd564730a61.exe File created C:\Windows\SysWOW64\vcmgcd32.dll 0f4cde4fb7d3c9686dbb0300761d42bf074567719c1f0330adcaebd564730a61.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 0f4cde4fb7d3c9686dbb0300761d42bf074567719c1f0330adcaebd564730a61.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4596 0f4cde4fb7d3c9686dbb0300761d42bf074567719c1f0330adcaebd564730a61.exe 4596 0f4cde4fb7d3c9686dbb0300761d42bf074567719c1f0330adcaebd564730a61.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4596 0f4cde4fb7d3c9686dbb0300761d42bf074567719c1f0330adcaebd564730a61.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f4cde4fb7d3c9686dbb0300761d42bf074567719c1f0330adcaebd564730a61.exe"C:\Users\Admin\AppData\Local\Temp\0f4cde4fb7d3c9686dbb0300761d42bf074567719c1f0330adcaebd564730a61.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4596
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD5ae22ca9f11ade8e362254b452cc07f78
SHA14b3cb548c547d3be76e571e0579a609969b05975
SHA25620cbcc9d1e6bd3c7ccacbe81fd26551b2ccfc02c00e8f948b9e9016c8b401db6
SHA5129e1c725758a284ec9132f393a0b27b019a7dde32dc0649b468152876b1c77b195abc9689b732144d8c5b4d0b5fcb960a3074264cab75e6681932d3da2a644bc1