Analysis
-
max time kernel
102s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 19:06
Behavioral task
behavioral1
Sample
JZ5Uɫվ.url
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
JZ5Uɫվ.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
XMP_NoAD_V2.0.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
XMP_NoAD_V2.0.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
ʹñض.url
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
ʹñض.url
Resource
win10v2004-20220812-en
General
-
Target
XMP_NoAD_V2.0.exe
-
Size
1.0MB
-
MD5
9dec4f8db5b03f8f784f00fa5b325196
-
SHA1
d2ff03854e7eb221204b3d24c07f32589aa6c19b
-
SHA256
c273053368c272e3f5099a3e5fd34175300a6c24dbc74976fc22fb28b4d19557
-
SHA512
61bc741b2cf377eb2dca17c04c78d8edfae906c3fee97ccd848143e25186305557f440057178f0e0f23c37d2e81668e8d97aef8a16637b7efe13837d67174e85
-
SSDEEP
24576:OdgtZtn7wBOlLSjQLgqXu+mBI6zQG+YMqI/l8aLWN:OdAVtScgqK9Q9DqId89
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral3/memory/1788-55-0x0000000000400000-0x000000000061E000-memory.dmp upx behavioral3/memory/1788-56-0x0000000000400000-0x000000000061E000-memory.dmp upx -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
XMP_NoAD_V2.0.exepid process 1788 XMP_NoAD_V2.0.exe 1788 XMP_NoAD_V2.0.exe 1788 XMP_NoAD_V2.0.exe