Overview

overview

8

Static

static

1fe073eef2...73.exe

windows7-x64

8

1fe073eef2...73.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    42s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    27/10/2022, 20:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    1fe073eef21e0bafafd35e29d8e30cd5797a5b4d7b46de51a8517c4962e32973.exe

  • Size

    4.6MB

  • MD5

    4846cb0101d8dd94c709aef6c2a303d9

  • SHA1

    a98f2c9c5afbf93525b45200379611aebc573308

  • SHA256

    1fe073eef21e0bafafd35e29d8e30cd5797a5b4d7b46de51a8517c4962e32973

  • SHA512

    ddb7e719365a82cbfee257128587c7cb025d9b19817043bca413c004d312cf4c0ce65fcc6aaf40473fb49b0ad2afe6ac3ee44680fe4c008cd0d0c9de840b8413

  • SSDEEP

    98304:X+nyZHbatroz/gau6DdXw+fsTq0Elwb9+Z8F:cy1baBoGqdvs20E+b9+

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1fe073eef21e0bafafd35e29d8e30cd5797a5b4d7b46de51a8517c4962e32973.exe
    "C:\Users\Admin\AppData\Local\Temp\1fe073eef21e0bafafd35e29d8e30cd5797a5b4d7b46de51a8517c4962e32973.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1052
    • C:\Users\Admin\AppData\Local\Temp\YShow3D.exe
      C:\Users\Admin\AppData\Local\Temp\\YShow3D.exe /i ÕÒ²»µ½Ö¸¶¨µÄ¼ÓÃÜËø£¡ /t ÌáʾÐÅÏ¢£º /k 16
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1240

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\YShow3D.exe
          Filesize

          60KB

          MD5

          0cfffed1dc3d1749f91b988d6158d3b4

          SHA1

          c2e99d01c9efadb836d8b6024988d99bdb2ad2b5

          SHA256

          1acf2a7c917d563c43d42af636b271763dff4d72d8e71931f8201078cf03645a

          SHA512

          b13ee45d814bc8669deeb02a9226f6fadfeb9db48991d2a35bccb8d5d36898c929193206957cbdeb0bb5fce022576c287b304eb156b40ea422f4785ad9ba2b77

          Download Submit

        • \Users\Admin\AppData\Local\Temp\YShow3D.exe
          Filesize

          60KB

          MD5

          0cfffed1dc3d1749f91b988d6158d3b4

          SHA1

          c2e99d01c9efadb836d8b6024988d99bdb2ad2b5

          SHA256

          1acf2a7c917d563c43d42af636b271763dff4d72d8e71931f8201078cf03645a

          SHA512

          b13ee45d814bc8669deeb02a9226f6fadfeb9db48991d2a35bccb8d5d36898c929193206957cbdeb0bb5fce022576c287b304eb156b40ea422f4785ad9ba2b77

          Download Submit

        • \Users\Admin\AppData\Local\Temp\YShow3D.exe
          Filesize

          60KB

          MD5

          0cfffed1dc3d1749f91b988d6158d3b4

          SHA1

          c2e99d01c9efadb836d8b6024988d99bdb2ad2b5

          SHA256

          1acf2a7c917d563c43d42af636b271763dff4d72d8e71931f8201078cf03645a

          SHA512

          b13ee45d814bc8669deeb02a9226f6fadfeb9db48991d2a35bccb8d5d36898c929193206957cbdeb0bb5fce022576c287b304eb156b40ea422f4785ad9ba2b77

          Download Submit

        • memory/1052-58-0x0000000000380000-0x00000000003DA000-memory.dmp

          Filesize

          360KB

          Download