Analysis
-
max time kernel
45s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 07:55
Static task
static1
Behavioral task
behavioral1
Sample
09e84d33dd30f4994cf5c58c4dd322f73272f089129ff169fd90eacb5e929997.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
09e84d33dd30f4994cf5c58c4dd322f73272f089129ff169fd90eacb5e929997.exe
Resource
win10v2004-20221111-en
General
-
Target
09e84d33dd30f4994cf5c58c4dd322f73272f089129ff169fd90eacb5e929997.exe
-
Size
1.1MB
-
MD5
f60d9934e47cc643e0b3bc35c1f5bb94
-
SHA1
549a31d8aeadd3b3197d38a711461910e30a5a6a
-
SHA256
09e84d33dd30f4994cf5c58c4dd322f73272f089129ff169fd90eacb5e929997
-
SHA512
f6010e17e1a2dbba74b8b19dac61eb9c7f3817b54b6b9d38e8d4ea6794c28038a252511cad612e43ef79d64e3eb84dd1065c93cb04c64925c40bc9fc5c1e1d90
-
SSDEEP
24576:OsGd5yK5q/OzoVWuvQ0Ukz2zfA3iq0QIBhX5w:OsrKRjj0HGfh5w
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
09e84d33dd30f4994cf5c58c4dd322f73272f089129ff169fd90eacb5e929997.exepid process 1764 09e84d33dd30f4994cf5c58c4dd322f73272f089129ff169fd90eacb5e929997.exe 1764 09e84d33dd30f4994cf5c58c4dd322f73272f089129ff169fd90eacb5e929997.exe -
Drops file in System32 directory 2 IoCs
Processes:
09e84d33dd30f4994cf5c58c4dd322f73272f089129ff169fd90eacb5e929997.exedescription ioc process File created C:\Windows\SysWOW64\ESPI11.dll 09e84d33dd30f4994cf5c58c4dd322f73272f089129ff169fd90eacb5e929997.exe File opened for modification C:\Windows\SysWOW64\ESPI11.dll 09e84d33dd30f4994cf5c58c4dd322f73272f089129ff169fd90eacb5e929997.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
09e84d33dd30f4994cf5c58c4dd322f73272f089129ff169fd90eacb5e929997.exepid process 1764 09e84d33dd30f4994cf5c58c4dd322f73272f089129ff169fd90eacb5e929997.exe 1764 09e84d33dd30f4994cf5c58c4dd322f73272f089129ff169fd90eacb5e929997.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\09e84d33dd30f4994cf5c58c4dd322f73272f089129ff169fd90eacb5e929997.exe"C:\Users\Admin\AppData\Local\Temp\09e84d33dd30f4994cf5c58c4dd322f73272f089129ff169fd90eacb5e929997.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1764
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120KB
MD5b4c2caaa15d4e505ad2858ab15eafb58
SHA1a1c30a4d016f1c6bd3bf50e36767af8af166d59b
SHA25693e03eadd330242f2394c15cd32857194e5b80f6300835ef77f8558ca70a2ef1
SHA51209b5903a579685522a521cec3b6026ab0d7b9cff3099f032254dbd2b48fbbdd9a7411c0765049784c64f520d41916e681cae206a736b4fab1868f449e84b4bf2
-
Filesize
120KB
MD5b4c2caaa15d4e505ad2858ab15eafb58
SHA1a1c30a4d016f1c6bd3bf50e36767af8af166d59b
SHA25693e03eadd330242f2394c15cd32857194e5b80f6300835ef77f8558ca70a2ef1
SHA51209b5903a579685522a521cec3b6026ab0d7b9cff3099f032254dbd2b48fbbdd9a7411c0765049784c64f520d41916e681cae206a736b4fab1868f449e84b4bf2