Analysis
-
max time kernel
147s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2022 01:08
Behavioral task
behavioral1
Sample
e50e02402e98934f92c2ee5a6fd518e3c30ff280b6bde31b735ee57cec7cd90b.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
e50e02402e98934f92c2ee5a6fd518e3c30ff280b6bde31b735ee57cec7cd90b.exe
Resource
win10v2004-20220812-en
General
-
Target
e50e02402e98934f92c2ee5a6fd518e3c30ff280b6bde31b735ee57cec7cd90b.exe
-
Size
48KB
-
MD5
386d51c3060d2b5c17a674a9bfa6ea30
-
SHA1
d19f9cde25f836e59faf3ebe6dc8c4fab82d0b57
-
SHA256
e50e02402e98934f92c2ee5a6fd518e3c30ff280b6bde31b735ee57cec7cd90b
-
SHA512
56a1fab08ee1f5dd7d624af05f72ef9663d2b61d48072d44f3e63c04c8bec635a4c1cc31d300f916b54af297bcfac6eefc5ea7dbc3d42a9f32fae99ff0f701a6
-
SSDEEP
768:YJTXh5hlnYot6X4gBwt69WmxztHLfYzn21/00Ao7w0ldCL5NXRTotOO/epLuWD7:iXh5hlnY26Xz58mxxHTYznszlULnhToy
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4968-132-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/4968-133-0x0000000000400000-0x000000000040C000-memory.dmp upx -
Loads dropped DLL 1 IoCs
pid Process 4968 e50e02402e98934f92c2ee5a6fd518e3c30ff280b6bde31b735ee57cec7cd90b.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 4968 e50e02402e98934f92c2ee5a6fd518e3c30ff280b6bde31b735ee57cec7cd90b.exe 4968 e50e02402e98934f92c2ee5a6fd518e3c30ff280b6bde31b735ee57cec7cd90b.exe 4968 e50e02402e98934f92c2ee5a6fd518e3c30ff280b6bde31b735ee57cec7cd90b.exe 4968 e50e02402e98934f92c2ee5a6fd518e3c30ff280b6bde31b735ee57cec7cd90b.exe 4968 e50e02402e98934f92c2ee5a6fd518e3c30ff280b6bde31b735ee57cec7cd90b.exe 4968 e50e02402e98934f92c2ee5a6fd518e3c30ff280b6bde31b735ee57cec7cd90b.exe 4968 e50e02402e98934f92c2ee5a6fd518e3c30ff280b6bde31b735ee57cec7cd90b.exe 4968 e50e02402e98934f92c2ee5a6fd518e3c30ff280b6bde31b735ee57cec7cd90b.exe 4968 e50e02402e98934f92c2ee5a6fd518e3c30ff280b6bde31b735ee57cec7cd90b.exe 4968 e50e02402e98934f92c2ee5a6fd518e3c30ff280b6bde31b735ee57cec7cd90b.exe 4968 e50e02402e98934f92c2ee5a6fd518e3c30ff280b6bde31b735ee57cec7cd90b.exe 4968 e50e02402e98934f92c2ee5a6fd518e3c30ff280b6bde31b735ee57cec7cd90b.exe 4968 e50e02402e98934f92c2ee5a6fd518e3c30ff280b6bde31b735ee57cec7cd90b.exe 4968 e50e02402e98934f92c2ee5a6fd518e3c30ff280b6bde31b735ee57cec7cd90b.exe 4968 e50e02402e98934f92c2ee5a6fd518e3c30ff280b6bde31b735ee57cec7cd90b.exe 4968 e50e02402e98934f92c2ee5a6fd518e3c30ff280b6bde31b735ee57cec7cd90b.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4968 e50e02402e98934f92c2ee5a6fd518e3c30ff280b6bde31b735ee57cec7cd90b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e50e02402e98934f92c2ee5a6fd518e3c30ff280b6bde31b735ee57cec7cd90b.exe"C:\Users\Admin\AppData\Local\Temp\e50e02402e98934f92c2ee5a6fd518e3c30ff280b6bde31b735ee57cec7cd90b.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4968
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5bb46a1fd40292d66d63d210bb9a06b00
SHA14893b161fe7cb1b7bf5170af826f51a3e2e07ccc
SHA2566bce8a8e0ed09ee640aadf62d64f8aee6f6ab73aeb4e4a2ae735793c33c0afb7
SHA512c61bd0247035723de783e4c879a0a9b341a37b3340c57f02747f569f90d77cbb594849e177a455e240959e4e414ff2c138dd9176257d400f861122e4554a6fb6