Analysis

  • max time kernel
    45s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    27-11-2022 07:55

General

  • Target

    09e84d33dd30f4994cf5c58c4dd322f73272f089129ff169fd90eacb5e929997.exe

  • Size

    1.1MB

  • MD5

    f60d9934e47cc643e0b3bc35c1f5bb94

  • SHA1

    549a31d8aeadd3b3197d38a711461910e30a5a6a

  • SHA256

    09e84d33dd30f4994cf5c58c4dd322f73272f089129ff169fd90eacb5e929997

  • SHA512

    f6010e17e1a2dbba74b8b19dac61eb9c7f3817b54b6b9d38e8d4ea6794c28038a252511cad612e43ef79d64e3eb84dd1065c93cb04c64925c40bc9fc5c1e1d90

  • SSDEEP

    24576:OsGd5yK5q/OzoVWuvQ0Ukz2zfA3iq0QIBhX5w:OsrKRjj0HGfh5w

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\09e84d33dd30f4994cf5c58c4dd322f73272f089129ff169fd90eacb5e929997.exe
    "C:\Users\Admin\AppData\Local\Temp\09e84d33dd30f4994cf5c58c4dd322f73272f089129ff169fd90eacb5e929997.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    PID:1764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\ESPI11.dll

    Filesize

    120KB

    MD5

    b4c2caaa15d4e505ad2858ab15eafb58

    SHA1

    a1c30a4d016f1c6bd3bf50e36767af8af166d59b

    SHA256

    93e03eadd330242f2394c15cd32857194e5b80f6300835ef77f8558ca70a2ef1

    SHA512

    09b5903a579685522a521cec3b6026ab0d7b9cff3099f032254dbd2b48fbbdd9a7411c0765049784c64f520d41916e681cae206a736b4fab1868f449e84b4bf2

  • \Windows\SysWOW64\ESPI11.dll

    Filesize

    120KB

    MD5

    b4c2caaa15d4e505ad2858ab15eafb58

    SHA1

    a1c30a4d016f1c6bd3bf50e36767af8af166d59b

    SHA256

    93e03eadd330242f2394c15cd32857194e5b80f6300835ef77f8558ca70a2ef1

    SHA512

    09b5903a579685522a521cec3b6026ab0d7b9cff3099f032254dbd2b48fbbdd9a7411c0765049784c64f520d41916e681cae206a736b4fab1868f449e84b4bf2

  • memory/1764-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

    Filesize

    8KB