Analysis

  • max time kernel
    395s
  • max time network
    451s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 12:46

General

  • Target

    ede49abe97d6f0badf4ae93c25b85963a611c138bf6996561f049e3136302c36.exe

  • Size

    328KB

  • MD5

    5308e99c67ca2233a5bede8d74c158bf

  • SHA1

    4b16cb5cf8899147cd5bb82af5d7567d831b8007

  • SHA256

    ede49abe97d6f0badf4ae93c25b85963a611c138bf6996561f049e3136302c36

  • SHA512

    04f83b08ff965e689f69311d33dc39319f6bb3f2564120a98d3631f88cd581c784c491be96bde78a0aed9735fdfafc47c464b97eed5a59c6b69d6ef6a601ec03

  • SSDEEP

    6144:OIWbEGsxdTGzTb1P6LG/J9hS14sCIFQwaEyUNxYrYBei6C3Y6t:OISEGsx68LG/J9h1sQuxYrQUCdt

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ede49abe97d6f0badf4ae93c25b85963a611c138bf6996561f049e3136302c36.exe
    "C:\Users\Admin\AppData\Local\Temp\ede49abe97d6f0badf4ae93c25b85963a611c138bf6996561f049e3136302c36.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:1612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\dfs57C1.tmp

    Filesize

    496KB

    MD5

    6a23beb2b76338c8f124532fdd2c652c

    SHA1

    18ee40972642312557ac3ba105b21b009ec4fec6

    SHA256

    1d04c205bbdc77fe29505c16c0ba516ad32ce1b2e02de77910bc632d30ea22eb

    SHA512

    caa57a55b18b1479127191d787bf6324ff444437f220f520e7fe1f1594840320c80e52f283408c628771d8399dbc4555a82651df4bcc730e7453d18e39b60f01

  • C:\Users\Admin\AppData\Local\Temp\dfs57C1.tmp

    Filesize

    496KB

    MD5

    6a23beb2b76338c8f124532fdd2c652c

    SHA1

    18ee40972642312557ac3ba105b21b009ec4fec6

    SHA256

    1d04c205bbdc77fe29505c16c0ba516ad32ce1b2e02de77910bc632d30ea22eb

    SHA512

    caa57a55b18b1479127191d787bf6324ff444437f220f520e7fe1f1594840320c80e52f283408c628771d8399dbc4555a82651df4bcc730e7453d18e39b60f01

  • memory/1612-132-0x0000000000130000-0x0000000000202000-memory.dmp

    Filesize

    840KB

  • memory/1612-135-0x0000000004E00000-0x0000000004E82000-memory.dmp

    Filesize

    520KB

  • memory/1612-136-0x0000000000AE0000-0x0000000000AE3000-memory.dmp

    Filesize

    12KB

  • memory/1612-137-0x0000000005830000-0x0000000005DD4000-memory.dmp

    Filesize

    5.6MB

  • memory/1612-138-0x0000000005360000-0x00000000053F2000-memory.dmp

    Filesize

    584KB

  • memory/1612-139-0x0000000000130000-0x0000000000202000-memory.dmp

    Filesize

    840KB

  • memory/1612-140-0x0000000005750000-0x000000000575A000-memory.dmp

    Filesize

    40KB