663c2dbb3369e9a67a3e995f714154f4c275906c96fb0af24c7437c07ed542d1

Analysis

max time kernel
128s
max time network
141s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12/01/2023, 03:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61a40094b63c6d2bb8a1f823cfedb09a12c12a56ab5b0e3df23d0083789e5b60.exe
Size

1.4MB
MD5

494f68dd5ef8b1684099a4ee87c9406c
SHA1

0fd737f070f8bd3076fae7baeb201993a2fd6faa
SHA256

61a40094b63c6d2bb8a1f823cfedb09a12c12a56ab5b0e3df23d0083789e5b60
SHA512

cc264dcf386dbb282857524b96759b35f91951465cc79ddb07680d0fed3660c244baeb6dde2f0b7eead0c0161925b62d3b818ba95527be51a7e772b2c7fadafa
SSDEEP

24576:vlsopsrCHoeC7fAoK56DlfSB9DKG7hYfkRQRGcsunX8JyFH8R+fmrjswhUAnV:vlsoWrCHAfA0DlKAGqkC8qjc9r4qUE

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1684	N11W94UKOS15G7H37U461NA.exe

Loads dropped DLL 1 IoCs

pid	Process
1684	N11W94UKOS15G7H37U461NA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1684	N11W94UKOS15G7H37U461NA.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1684	2028	61a40094b63c6d2bb8a1f823cfedb09a12c12a56ab5b0e3df23d0083789e5b60.exe	27
PID 2028 wrote to memory of 1684	2028	61a40094b63c6d2bb8a1f823cfedb09a12c12a56ab5b0e3df23d0083789e5b60.exe	27
PID 2028 wrote to memory of 1684	2028	61a40094b63c6d2bb8a1f823cfedb09a12c12a56ab5b0e3df23d0083789e5b60.exe	27
PID 2028 wrote to memory of 1684	2028	61a40094b63c6d2bb8a1f823cfedb09a12c12a56ab5b0e3df23d0083789e5b60.exe	27

C:\Users\Admin\AppData\Local\Temp\61a40094b63c6d2bb8a1f823cfedb09a12c12a56ab5b0e3df23d0083789e5b60.exe
"C:\Users\Admin\AppData\Local\Temp\61a40094b63c6d2bb8a1f823cfedb09a12c12a56ab5b0e3df23d0083789e5b60.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Users\Admin\AppData\Roaming\rl82528f4h6k8skc83jqrs100\N11W94UKOS15G7H37U461NA.exe
  C:\Users\Admin\AppData\Roaming\rl82528f4h6k8skc83jqrs100\N11W94UKOS15G7H37U461NA.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\rl82528f4h6k8skc83jqrs100\N11W94UKOS15G7H37U461NA.data

Filesize
252B

MD5
7ca773e631f4e528d11da2063b6e50e4

SHA1
5a5227e1e932a0f30fe2aeca80ef16d492881407

SHA256
abd313f0128abb934e019c96509e7fae1514bec3535b455779b81405871796b3

SHA512
444df45d85857e97c75b4fde895b13613594ac568092f401d846b0fe66eff82d9fa502fcda2d38e7851cf359dd1893ff78d436fef53841b1e54f3f99a988c7f1

Download Submit
C:\Users\Admin\AppData\Roaming\rl82528f4h6k8skc83jqrs100\N11W94UKOS15G7H37U461NA.exe

Filesize
678KB

MD5
9c38e5cfa356b47b1c060179f385f1e2

SHA1
f13ec2136c092dff2a095e2b3040977200ae0b97

SHA256
1fe4c08701c24b3592933c073ce170268ac2809e7f3b8e65f46b0e54b01e16cc

SHA512
c01972e1a8057ce9731165e31833d4c00d183438be9201b114b31eb56ea8a809d8408ff36802f3cb27849e8a20420619c4456dfd6ee28ab8ba426c3904ac37bb

Download Submit
C:\Users\Admin\AppData\Roaming\rl82528f4h6k8skc83jqrs100\N11W94UKOS15G7H37U461NA.exe

Filesize
678KB

MD5
9c38e5cfa356b47b1c060179f385f1e2

SHA1
f13ec2136c092dff2a095e2b3040977200ae0b97

SHA256
1fe4c08701c24b3592933c073ce170268ac2809e7f3b8e65f46b0e54b01e16cc

SHA512
c01972e1a8057ce9731165e31833d4c00d183438be9201b114b31eb56ea8a809d8408ff36802f3cb27849e8a20420619c4456dfd6ee28ab8ba426c3904ac37bb

Download Submit
C:\Users\Admin\AppData\Roaming\rl82528f4h6k8skc83jqrs100\libcef.dll

Filesize
448KB

MD5
d93c9553cac111bf10ea9fef66c018cb

SHA1
dffa7b8e5b4b5a8cb41fa55d3bdc485ad9f89f85

SHA256
f3c7f9276cf0406f5799d88df0b9e8db7cc33a4ea61e7e0579ca6f57610bb77a

SHA512
cc91434ceaf6ec21db0253d9db959d1f6abed7c58b2c7912d604d7c3ab07ea372c43ac4210fdf3004ac62e2e995afb636dd4fd347a5623acba38d5394de248f1

Download Submit
\Users\Admin\AppData\Roaming\rl82528f4h6k8skc83jqrs100\libcef.dll

Filesize
448KB

MD5
d93c9553cac111bf10ea9fef66c018cb

SHA1
dffa7b8e5b4b5a8cb41fa55d3bdc485ad9f89f85

SHA256
f3c7f9276cf0406f5799d88df0b9e8db7cc33a4ea61e7e0579ca6f57610bb77a

SHA512
cc91434ceaf6ec21db0253d9db959d1f6abed7c58b2c7912d604d7c3ab07ea372c43ac4210fdf3004ac62e2e995afb636dd4fd347a5623acba38d5394de248f1

Download Submit
memory/1684-59-0x0000000075561000-0x0000000075563000-memory.dmp

Filesize
8KB

Download
memory/1684-61-0x0000000002240000-0x000000000232C000-memory.dmp

Filesize
944KB

Download
memory/1684-63-0x0000000002240000-0x000000000232C000-memory.dmp

Filesize
944KB

Download
memory/2028-54-0x000007FEFB8D1000-0x000007FEFB8D3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads