Analysis
-
max time kernel
82s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 12:21
Behavioral task
behavioral1
Sample
190bd201bba9ed7b41399b889d737bb35c7be304820901edb76223e03917461d.exe
Resource
win7-20220812-en
General
-
Target
190bd201bba9ed7b41399b889d737bb35c7be304820901edb76223e03917461d.exe
-
Size
3.6MB
-
MD5
f3b79cfc8f0c006b0a2059bbc085f41e
-
SHA1
85691c69807cd536aaf8163d31771fddcbe61abf
-
SHA256
190bd201bba9ed7b41399b889d737bb35c7be304820901edb76223e03917461d
-
SHA512
e91ec0ddaa121c8fcd303389071f2608728a0ab49cfc73f612808846cdaeb3077281c71158ff883591102c130c90648feba37a79301833a3975800efd9645f93
-
SSDEEP
98304:xQmhlyDrLjdbaHDkv1W1vBEYCqb61sWLhBs+QlOfbC2M:ymhgTjdbM4W1vBp1mCiVfbCp
Malware Config
Signatures
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\PEAS.dll aspack_v212_v242 -
Processes:
resource yara_rule behavioral2/memory/4980-135-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4980-136-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4980-137-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4980-139-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4980-141-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4980-143-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4980-145-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4980-147-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4980-149-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4980-151-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4980-153-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4980-155-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4980-157-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4980-159-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4980-161-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4980-163-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4980-165-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4980-167-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4980-169-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4980-171-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4980-173-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4980-175-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4980-177-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4980-179-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4980-184-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Processes:
resource yara_rule behavioral2/memory/4980-132-0x0000000000400000-0x0000000000C5C000-memory.dmp vmprotect behavioral2/memory/4980-133-0x0000000000400000-0x0000000000C5C000-memory.dmp vmprotect behavioral2/memory/4980-178-0x0000000000400000-0x0000000000C5C000-memory.dmp vmprotect behavioral2/memory/4980-186-0x0000000000400000-0x0000000000C5C000-memory.dmp vmprotect -
Loads dropped DLL 1 IoCs
Processes:
190bd201bba9ed7b41399b889d737bb35c7be304820901edb76223e03917461d.exepid process 4980 190bd201bba9ed7b41399b889d737bb35c7be304820901edb76223e03917461d.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
190bd201bba9ed7b41399b889d737bb35c7be304820901edb76223e03917461d.exepid process 4980 190bd201bba9ed7b41399b889d737bb35c7be304820901edb76223e03917461d.exe 4980 190bd201bba9ed7b41399b889d737bb35c7be304820901edb76223e03917461d.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
190bd201bba9ed7b41399b889d737bb35c7be304820901edb76223e03917461d.exepid process 4980 190bd201bba9ed7b41399b889d737bb35c7be304820901edb76223e03917461d.exe 4980 190bd201bba9ed7b41399b889d737bb35c7be304820901edb76223e03917461d.exe 4980 190bd201bba9ed7b41399b889d737bb35c7be304820901edb76223e03917461d.exe 4980 190bd201bba9ed7b41399b889d737bb35c7be304820901edb76223e03917461d.exe 4980 190bd201bba9ed7b41399b889d737bb35c7be304820901edb76223e03917461d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\190bd201bba9ed7b41399b889d737bb35c7be304820901edb76223e03917461d.exe"C:\Users\Admin\AppData\Local\Temp\190bd201bba9ed7b41399b889d737bb35c7be304820901edb76223e03917461d.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\PEAS.dllFilesize
917KB
MD54c0f0256ac25b4d068e02d657f082c37
SHA1ec6807e49741f8fe0e71943bd178b3e36de7bc4a
SHA2567326a5c9c8d6b9c1ef5dd991578920dfff0819a05326d91742711828032db07d
SHA512614b58a1e4d8f613fdab725f22927db2d696e9ca8e13db3686e7cca1eea48da3ce472d5055e0a8945dd95ab6b31c86cd3cac405a47cb6ef70f90d59541405850
-
memory/4980-161-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4980-145-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4980-136-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4980-163-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4980-139-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4980-141-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4980-143-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4980-165-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4980-147-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4980-149-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4980-151-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4980-153-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4980-155-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4980-167-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4980-159-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4980-132-0x0000000000400000-0x0000000000C5C000-memory.dmpFilesize
8.4MB
-
memory/4980-137-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4980-135-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4980-157-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4980-169-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4980-171-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4980-173-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4980-175-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4980-177-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4980-178-0x0000000000400000-0x0000000000C5C000-memory.dmpFilesize
8.4MB
-
memory/4980-179-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4980-133-0x0000000000400000-0x0000000000C5C000-memory.dmpFilesize
8.4MB
-
memory/4980-181-0x0000000071680000-0x000000007185F000-memory.dmpFilesize
1.9MB
-
memory/4980-182-0x0000000071680000-0x000000007185F000-memory.dmpFilesize
1.9MB
-
memory/4980-183-0x0000000071680000-0x000000007185F000-memory.dmpFilesize
1.9MB
-
memory/4980-184-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4980-185-0x0000000071680000-0x000000007185F000-memory.dmpFilesize
1.9MB
-
memory/4980-186-0x0000000000400000-0x0000000000C5C000-memory.dmpFilesize
8.4MB