Analysis

  • max time kernel
    43s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    08-10-2022 21:54

General

  • Target

    3ebe14704d81f0d5c48561d603acf697479c2fee8b195222b4f031544ed02292.exe

  • Size

    28KB

  • MD5

    75821aba6e821e308bfab3bb03d98906

  • SHA1

    14c0c7f3332ac673895d27c79cc7c422b123bfa4

  • SHA256

    3ebe14704d81f0d5c48561d603acf697479c2fee8b195222b4f031544ed02292

  • SHA512

    fe942991c9176fc94898dc016221c0ff13ec1de09aa779908f5c41113fb63b3c49f4ce860855d56b27cdc8594dac95bb7f407f4833b169c024fd19548cb2b6c0

  • SSDEEP

    768:SzTlSBQB7BCBtB0BfBmBwBJBaBqBMBoBJBDB/Bnlke0dP8c8ey8WHZ7j:ITlsDIHZ

Malware Config

Signatures

  • joker

    Joker is an Android malware that targets billing and SMS fraud.

  • Downloads MZ/PE file
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3ebe14704d81f0d5c48561d603acf697479c2fee8b195222b4f031544ed02292.exe
    "C:\Users\Admin\AppData\Local\Temp\3ebe14704d81f0d5c48561d603acf697479c2fee8b195222b4f031544ed02292.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\inatall.jpg

    Filesize

    32KB

    MD5

    1ff57380de261728cf3a817eabd2c878

    SHA1

    ffdac51244d503ac31bec8fe116b267037a4fadb

    SHA256

    04084bb2415a4ceda8bdb01d6dc647c164968fc8405968f980e73cebedc6f933

    SHA512

    2586d301a126d8ff2232e1118238fa957ed72fb31d69e7f2cd069ff1fb363c8c3b9ae52c024f1554bd2676f5d32fb0816c0d5ae5fde7d9482edd809d27bc7be7

  • memory/812-54-0x0000000075131000-0x0000000075133000-memory.dmp

    Filesize

    8KB