Analysis

  • max time kernel
    77s
  • max time network
    113s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    29/11/2022, 11:19

General

  • Target

    74aef2f419e705ebd8139024a2715c97b72619502e804e6aabeaa7414cb766ca.exe

  • Size

    472KB

  • MD5

    5460113722a8266a86734b3283991920

  • SHA1

    741308a9ea26c5e14935e036a36225aa4f219132

  • SHA256

    74aef2f419e705ebd8139024a2715c97b72619502e804e6aabeaa7414cb766ca

  • SHA512

    d63690f0c896b9ab78153c96834bc375455bf16d8373bd72354173f7d535f2c5276f7481d8e70761bd9b2312f93553b582f707b85e769ffcbf6d10f846713a33

  • SSDEEP

    12288:GmNQoc2wgN+SnjAkv1DpZeED4m7hoaiRsQ2pGgHx+i:Gm+otN+SnJVZXLhotszEgHx+i

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\74aef2f419e705ebd8139024a2715c97b72619502e804e6aabeaa7414cb766ca.exe
    "C:\Users\Admin\AppData\Local\Temp\74aef2f419e705ebd8139024a2715c97b72619502e804e6aabeaa7414cb766ca.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:936
  • C:\Windows\Qmkhqqy.exe
    C:\Windows\Qmkhqqy.exe
    1⤵
    • Executes dropped EXE
    PID:868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Qmkhqqy.exe

    Filesize

    472KB

    MD5

    5460113722a8266a86734b3283991920

    SHA1

    741308a9ea26c5e14935e036a36225aa4f219132

    SHA256

    74aef2f419e705ebd8139024a2715c97b72619502e804e6aabeaa7414cb766ca

    SHA512

    d63690f0c896b9ab78153c96834bc375455bf16d8373bd72354173f7d535f2c5276f7481d8e70761bd9b2312f93553b582f707b85e769ffcbf6d10f846713a33

  • memory/868-59-0x0000000000400000-0x000000000047D000-memory.dmp

    Filesize

    500KB

  • memory/868-61-0x0000000000400000-0x000000000047D000-memory.dmp

    Filesize

    500KB

  • memory/936-54-0x0000000000400000-0x000000000047D000-memory.dmp

    Filesize

    500KB

  • memory/936-55-0x0000000076941000-0x0000000076943000-memory.dmp

    Filesize

    8KB

  • memory/936-56-0x0000000000400000-0x000000000047D000-memory.dmp

    Filesize

    500KB

  • memory/936-60-0x0000000000400000-0x000000000047D000-memory.dmp

    Filesize

    500KB