Analysis

  • max time kernel
    373s
  • max time network
    415s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-11-2022 16:52

General

  • Target

    fdffaee438a34b12c3ad1426a8c3dbcaa5649734868c68a785ed36f3c45c1e20.exe

  • Size

    2.4MB

  • MD5

    1af6299e2caa0527d8120c7a963b6654

  • SHA1

    be75093a4ebba211f8a183c8b2759d8cbd33622f

  • SHA256

    fdffaee438a34b12c3ad1426a8c3dbcaa5649734868c68a785ed36f3c45c1e20

  • SHA512

    7f53274b341a6262269f746463b3fd512a186ef178b2e3435166b39347f4456d469f49dbfa2cb83043515c665ef559e91afa2112840fd39ae1a1949cfa1c081a

  • SSDEEP

    24576:cuUTmNOrDY84Dt/XdYzBdu+CNIK2wad3Jd8Jyn7Z7JzC8DsHoMTMtbixxH0GP+CV:cUN849wxy3UfhqYOlDMv6

Score
8/10

Malware Config

Signatures

  • ASPack v2.12-2.42 2 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fdffaee438a34b12c3ad1426a8c3dbcaa5649734868c68a785ed36f3c45c1e20.exe
    "C:\Users\Admin\AppData\Local\Temp\fdffaee438a34b12c3ad1426a8c3dbcaa5649734868c68a785ed36f3c45c1e20.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1928
    • C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e5c4185.exe
      C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e5c4185.exe 240927125
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e5c4185.exe

    Filesize

    2.4MB

    MD5

    884fbfe4144fc9eecc39303715ca7bb0

    SHA1

    cbbd2745987da1ceeab3039ab3eca86a35bca4ed

    SHA256

    b4ad1a0b8a58a029a0373f4a177ee88484d1018847ec382f83348a6d34e710cb

    SHA512

    3580c5df15bc1469c07b8626c2f64f8eb97c6629485e65242e1e36c2372b41b84e2a833fa6f28fb2514d70c3c8842c6980a430999e863f65d31c47a302338b9b

  • C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e5c4185.exe

    Filesize

    2.4MB

    MD5

    884fbfe4144fc9eecc39303715ca7bb0

    SHA1

    cbbd2745987da1ceeab3039ab3eca86a35bca4ed

    SHA256

    b4ad1a0b8a58a029a0373f4a177ee88484d1018847ec382f83348a6d34e710cb

    SHA512

    3580c5df15bc1469c07b8626c2f64f8eb97c6629485e65242e1e36c2372b41b84e2a833fa6f28fb2514d70c3c8842c6980a430999e863f65d31c47a302338b9b

  • memory/1248-136-0x0000000000400000-0x00000000006C6028-memory.dmp

    Filesize

    2.8MB

  • memory/1928-132-0x0000000000400000-0x00000000006C6028-memory.dmp

    Filesize

    2.8MB