Analysis
-
max time kernel
373s -
max time network
415s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 16:52
Behavioral task
behavioral1
Sample
fdffaee438a34b12c3ad1426a8c3dbcaa5649734868c68a785ed36f3c45c1e20.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
fdffaee438a34b12c3ad1426a8c3dbcaa5649734868c68a785ed36f3c45c1e20.exe
Resource
win10v2004-20221111-en
General
-
Target
fdffaee438a34b12c3ad1426a8c3dbcaa5649734868c68a785ed36f3c45c1e20.exe
-
Size
2.4MB
-
MD5
1af6299e2caa0527d8120c7a963b6654
-
SHA1
be75093a4ebba211f8a183c8b2759d8cbd33622f
-
SHA256
fdffaee438a34b12c3ad1426a8c3dbcaa5649734868c68a785ed36f3c45c1e20
-
SHA512
7f53274b341a6262269f746463b3fd512a186ef178b2e3435166b39347f4456d469f49dbfa2cb83043515c665ef559e91afa2112840fd39ae1a1949cfa1c081a
-
SSDEEP
24576:cuUTmNOrDY84Dt/XdYzBdu+CNIK2wad3Jd8Jyn7Z7JzC8DsHoMTMtbixxH0GP+CV:cUN849wxy3UfhqYOlDMv6
Malware Config
Signatures
-
resource yara_rule behavioral2/files/0x0006000000022ddf-134.dat aspack_v212_v242 behavioral2/files/0x0006000000022ddf-135.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 1248 e5c4185.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1928 fdffaee438a34b12c3ad1426a8c3dbcaa5649734868c68a785ed36f3c45c1e20.exe 1928 fdffaee438a34b12c3ad1426a8c3dbcaa5649734868c68a785ed36f3c45c1e20.exe 1248 e5c4185.exe 1248 e5c4185.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1928 wrote to memory of 1248 1928 fdffaee438a34b12c3ad1426a8c3dbcaa5649734868c68a785ed36f3c45c1e20.exe 82 PID 1928 wrote to memory of 1248 1928 fdffaee438a34b12c3ad1426a8c3dbcaa5649734868c68a785ed36f3c45c1e20.exe 82 PID 1928 wrote to memory of 1248 1928 fdffaee438a34b12c3ad1426a8c3dbcaa5649734868c68a785ed36f3c45c1e20.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\fdffaee438a34b12c3ad1426a8c3dbcaa5649734868c68a785ed36f3c45c1e20.exe"C:\Users\Admin\AppData\Local\Temp\fdffaee438a34b12c3ad1426a8c3dbcaa5649734868c68a785ed36f3c45c1e20.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e5c4185.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e5c4185.exe 2409271252⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1248
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD5884fbfe4144fc9eecc39303715ca7bb0
SHA1cbbd2745987da1ceeab3039ab3eca86a35bca4ed
SHA256b4ad1a0b8a58a029a0373f4a177ee88484d1018847ec382f83348a6d34e710cb
SHA5123580c5df15bc1469c07b8626c2f64f8eb97c6629485e65242e1e36c2372b41b84e2a833fa6f28fb2514d70c3c8842c6980a430999e863f65d31c47a302338b9b
-
Filesize
2.4MB
MD5884fbfe4144fc9eecc39303715ca7bb0
SHA1cbbd2745987da1ceeab3039ab3eca86a35bca4ed
SHA256b4ad1a0b8a58a029a0373f4a177ee88484d1018847ec382f83348a6d34e710cb
SHA5123580c5df15bc1469c07b8626c2f64f8eb97c6629485e65242e1e36c2372b41b84e2a833fa6f28fb2514d70c3c8842c6980a430999e863f65d31c47a302338b9b