646c13593ec5d0d702d660a47a0cb6fab33366d15a67209a586ddf569eb634fa

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 18:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

646c13593ec5d0d702d660a47a0cb6fab33366d15a67209a586ddf569eb634fa.exe
Size

1.5MB
MD5

0654343ff5b074a7e3605c459d9e61f9
SHA1

ada4e786618eecf040c79a50c316e94560e7cef1
SHA256

646c13593ec5d0d702d660a47a0cb6fab33366d15a67209a586ddf569eb634fa
SHA512

92fcae598ebc6b87ff7d5db63d02bba41bc7815f77d0622dc0d53009c2bfc9cfeef81178e7bc93078b303de567752c6d705646dcc1dfa11a55d8ff03f1b6b7fa
SSDEEP

24576:NHRmKLopGIgRaVbYt8FbmIDZpfx7tapgEKpwuSF8KsZyoYj9C+rMDoogCg7mdJeC:XlKEKPSNNUDkhT6yC

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1352	6c086a.exe

Loads dropped DLL 2 IoCs

pid	Process
1688	646c13593ec5d0d702d660a47a0cb6fab33366d15a67209a586ddf569eb634fa.exe
1688	646c13593ec5d0d702d660a47a0cb6fab33366d15a67209a586ddf569eb634fa.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1352	6c086a.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1352	6c086a.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1688	646c13593ec5d0d702d660a47a0cb6fab33366d15a67209a586ddf569eb634fa.exe
1688	646c13593ec5d0d702d660a47a0cb6fab33366d15a67209a586ddf569eb634fa.exe
1352	6c086a.exe
1352	6c086a.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1352	1688	646c13593ec5d0d702d660a47a0cb6fab33366d15a67209a586ddf569eb634fa.exe	27
PID 1688 wrote to memory of 1352	1688	646c13593ec5d0d702d660a47a0cb6fab33366d15a67209a586ddf569eb634fa.exe	27
PID 1688 wrote to memory of 1352	1688	646c13593ec5d0d702d660a47a0cb6fab33366d15a67209a586ddf569eb634fa.exe	27
PID 1688 wrote to memory of 1352	1688	646c13593ec5d0d702d660a47a0cb6fab33366d15a67209a586ddf569eb634fa.exe	27

C:\Users\Admin\AppData\Local\Temp\646c13593ec5d0d702d660a47a0cb6fab33366d15a67209a586ddf569eb634fa.exe
"C:\Users\Admin\AppData\Local\Temp\646c13593ec5d0d702d660a47a0cb6fab33366d15a67209a586ddf569eb634fa.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\6c086a.exe
  C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\6c086a.exe 7080058
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\6c086a.exe

Filesize
1.5MB

MD5
9b30a1e16ede766f5bb7178545c746e7

SHA1
b366ced7809f4076bf51057b466175e10161f72a

SHA256
ce5ffa5f9a0571783a0f0eadee0599d58cfdf71f51c403854c253ccb433ff04f

SHA512
983d8867b7ad5f304fd1935a7cd2d96ea39b1b85b89f576df97e29878001ea04b548b450e18d541deb18af7981225427c6de6d9120d6aa50cdd3fe36f2aa7e13

Download Submit
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\6c086a.exe

Filesize
1.5MB

MD5
9b30a1e16ede766f5bb7178545c746e7

SHA1
b366ced7809f4076bf51057b466175e10161f72a

SHA256
ce5ffa5f9a0571783a0f0eadee0599d58cfdf71f51c403854c253ccb433ff04f

SHA512
983d8867b7ad5f304fd1935a7cd2d96ea39b1b85b89f576df97e29878001ea04b548b450e18d541deb18af7981225427c6de6d9120d6aa50cdd3fe36f2aa7e13

Download Submit
\Users\Admin\AppData\Local\Temp\ÅäÖÃ\6c086a.exe

Filesize
1.5MB

MD5
9b30a1e16ede766f5bb7178545c746e7

SHA1
b366ced7809f4076bf51057b466175e10161f72a

SHA256
ce5ffa5f9a0571783a0f0eadee0599d58cfdf71f51c403854c253ccb433ff04f

SHA512
983d8867b7ad5f304fd1935a7cd2d96ea39b1b85b89f576df97e29878001ea04b548b450e18d541deb18af7981225427c6de6d9120d6aa50cdd3fe36f2aa7e13

Download Submit
\Users\Admin\AppData\Local\Temp\ÅäÖÃ\6c086a.exe

Filesize
1.5MB

MD5
9b30a1e16ede766f5bb7178545c746e7

SHA1
b366ced7809f4076bf51057b466175e10161f72a

SHA256
ce5ffa5f9a0571783a0f0eadee0599d58cfdf71f51c403854c253ccb433ff04f

SHA512
983d8867b7ad5f304fd1935a7cd2d96ea39b1b85b89f576df97e29878001ea04b548b450e18d541deb18af7981225427c6de6d9120d6aa50cdd3fe36f2aa7e13

Download Submit
memory/1352-63-0x0000000000400000-0x00000000005CC033-memory.dmp

Filesize
1.8MB

Download
memory/1352-64-0x0000000000400000-0x00000000005CC033-memory.dmp

Filesize
1.8MB

Download
memory/1688-54-0x0000000000400000-0x00000000005CC033-memory.dmp

Filesize
1.8MB

Download
memory/1688-55-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1688-62-0x0000000000400000-0x00000000005CC033-memory.dmp

Filesize
1.8MB

Download