Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 19:06
Behavioral task
behavioral1
Sample
JZ5Uɫվ.url
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
JZ5Uɫվ.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
XMP_NoAD_V2.0.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
XMP_NoAD_V2.0.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
ʹñض.url
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
ʹñض.url
Resource
win10v2004-20220812-en
General
-
Target
XMP_NoAD_V2.0.exe
-
Size
1.0MB
-
MD5
9dec4f8db5b03f8f784f00fa5b325196
-
SHA1
d2ff03854e7eb221204b3d24c07f32589aa6c19b
-
SHA256
c273053368c272e3f5099a3e5fd34175300a6c24dbc74976fc22fb28b4d19557
-
SHA512
61bc741b2cf377eb2dca17c04c78d8edfae906c3fee97ccd848143e25186305557f440057178f0e0f23c37d2e81668e8d97aef8a16637b7efe13837d67174e85
-
SSDEEP
24576:OdgtZtn7wBOlLSjQLgqXu+mBI6zQG+YMqI/l8aLWN:OdAVtScgqK9Q9DqId89
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral4/memory/4696-132-0x0000000000400000-0x000000000061E000-memory.dmp upx behavioral4/memory/4696-133-0x0000000000400000-0x000000000061E000-memory.dmp upx -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
XMP_NoAD_V2.0.exepid process 4696 XMP_NoAD_V2.0.exe 4696 XMP_NoAD_V2.0.exe 4696 XMP_NoAD_V2.0.exe