Analysis
-
max time kernel
41s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
05-12-2022 23:52
Behavioral task
behavioral1
Sample
e5ff56ad63ae675e026e094a76ad7cfd4bd11cc398735d481751f8afc24ccec1.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e5ff56ad63ae675e026e094a76ad7cfd4bd11cc398735d481751f8afc24ccec1.exe
Resource
win10v2004-20220812-en
General
-
Target
e5ff56ad63ae675e026e094a76ad7cfd4bd11cc398735d481751f8afc24ccec1.exe
-
Size
706KB
-
MD5
b0236df8a5c8bb60f2bddf3acb3fc918
-
SHA1
64ee5213c0fb56e351c3a4991f88e46632adfa6e
-
SHA256
e5ff56ad63ae675e026e094a76ad7cfd4bd11cc398735d481751f8afc24ccec1
-
SHA512
4a28e43fe021cb836259858ae2df923037ab4d036e69db3397a52b3507169f95c4ebb0a1143ff48554dfdf03d9ef1b891ebf093e4244ac294a37e4e675bedd5c
-
SSDEEP
12288:yik2y3fRx3m73Cbfccr2J6iKwnU1aurh9cpCpC8bCWI+cCs/Q4bBcQSvSMiyYU:NkhfR5y3Sccr2J6gn039cpC7xITKvFYU
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/688-54-0x0000000000400000-0x00000000004B8000-memory.dmp upx behavioral1/memory/688-58-0x0000000000400000-0x00000000004B8000-memory.dmp upx -
Loads dropped DLL 1 IoCs
pid Process 688 e5ff56ad63ae675e026e094a76ad7cfd4bd11cc398735d481751f8afc24ccec1.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\fitooooo.dll e5ff56ad63ae675e026e094a76ad7cfd4bd11cc398735d481751f8afc24ccec1.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 688 e5ff56ad63ae675e026e094a76ad7cfd4bd11cc398735d481751f8afc24ccec1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5ff56ad63ae675e026e094a76ad7cfd4bd11cc398735d481751f8afc24ccec1.exe"C:\Users\Admin\AppData\Local\Temp\e5ff56ad63ae675e026e094a76ad7cfd4bd11cc398735d481751f8afc24ccec1.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:688
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5e45494ddae9b7eae720082b305795a94
SHA185ad31313d33b357254fcd180116e12b1e26cd85
SHA25686ccc12f870ba1a75dba78014fc9eafc5de669852ca503587d02070484cb56c0
SHA5121946c6ae3eacc3ccac3e868692bc222559961187b4bed1112e56dc61f5202e8f54a9b4d22a2d8fcd4cc0ddbb9cbe6eb030f14589bc7f2286f973611276f46901