Analysis
-
max time kernel
137s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20-10-2022 06:21
Behavioral task
behavioral1
Sample
84e54009ec410c9f9298e92c0372b4a6e34e06ac7ce4f53f33943dd7badcf8ac.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
84e54009ec410c9f9298e92c0372b4a6e34e06ac7ce4f53f33943dd7badcf8ac.exe
Resource
win10v2004-20220812-en
General
-
Target
84e54009ec410c9f9298e92c0372b4a6e34e06ac7ce4f53f33943dd7badcf8ac.exe
-
Size
37KB
-
MD5
778951dcd52df9b0dce208446e71f670
-
SHA1
8200d8fc8e51343021d9be03b042750f77a8393f
-
SHA256
84e54009ec410c9f9298e92c0372b4a6e34e06ac7ce4f53f33943dd7badcf8ac
-
SHA512
ccd35e945017dff13e1538dc5cddc085d3aba394247ecec5869fafb161a28ade27a71bfa0bf380a954d082372056d1a235a8634816fe57624dc931d3bce2fd4a
-
SSDEEP
768:a7p0s84jahW/1zNGfK6T29Ciqa3ChpWWulWhlWjdXKn7ObCmLReS2YqhjqH/ySNX:at0fg/yK6q9Aa3ChE1jdXeObDLISI2HL
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/5040-134-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral2/memory/5040-137-0x0000000000400000-0x0000000000416000-memory.dmp upx -
Loads dropped DLL 2 IoCs
pid Process 5040 84e54009ec410c9f9298e92c0372b4a6e34e06ac7ce4f53f33943dd7badcf8ac.exe 5040 84e54009ec410c9f9298e92c0372b4a6e34e06ac7ce4f53f33943dd7badcf8ac.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\atmQQ2.dll 84e54009ec410c9f9298e92c0372b4a6e34e06ac7ce4f53f33943dd7badcf8ac.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5040 84e54009ec410c9f9298e92c0372b4a6e34e06ac7ce4f53f33943dd7badcf8ac.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\84e54009ec410c9f9298e92c0372b4a6e34e06ac7ce4f53f33943dd7badcf8ac.exe"C:\Users\Admin\AppData\Local\Temp\84e54009ec410c9f9298e92c0372b4a6e34e06ac7ce4f53f33943dd7badcf8ac.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:5040
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD558a1b860aa52425d34eb01a94a1275aa
SHA105a5972c4fc446b1b9d3d1b85c95fd961bc6dc1e
SHA2565e295435c66777c36f1613613798d45c9f264321bb85a26034c65a321d26c6f0
SHA512cb06693550957e1cdc946f66071474d809ac3585dc38cb27f331da451498580690854ab3c350e866c11a9a6d71e43988a9151a63e317c19116bd5fe6d7bdef11
-
Filesize
21KB
MD558a1b860aa52425d34eb01a94a1275aa
SHA105a5972c4fc446b1b9d3d1b85c95fd961bc6dc1e
SHA2565e295435c66777c36f1613613798d45c9f264321bb85a26034c65a321d26c6f0
SHA512cb06693550957e1cdc946f66071474d809ac3585dc38cb27f331da451498580690854ab3c350e866c11a9a6d71e43988a9151a63e317c19116bd5fe6d7bdef11