Analysis
-
max time kernel
140s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2023 11:09
Static task
static1
Behavioral task
behavioral1
Sample
fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269.exe
Resource
win10v2004-20220901-en
General
-
Target
fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269.exe
-
Size
3.1MB
-
MD5
1cf79ab9c6f59e32f1d23f2bce0f5c0a
-
SHA1
67b6ba28ae46fbb1e17621a6482dfcab29730397
-
SHA256
fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269
-
SHA512
95a9709e2de04de5bd2bede0a4eb9923ca04ca67cd0ee44eca32ba79acb41a3a59ffc659162031950de4062db0c0fa586185b16f9029b94714fcfa616577dd5d
-
SSDEEP
24576:Rm26Xri0uQN3nOWq5DyOKqi479zObJ6CTmssk/MTOYf4jtlV4eRxGyoWIU5tYUpj:Co51EYatDxoWIyGeqkZi
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269.exedescription ioc process File opened (read-only) \??\O: fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269.exe File opened (read-only) \??\T: fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269.exe File opened (read-only) \??\V: fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269.exe File opened (read-only) \??\Y: fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269.exe File opened (read-only) \??\Z: fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269.exe File opened (read-only) \??\P: fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269.exe File opened (read-only) \??\R: fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269.exe File opened (read-only) \??\E: fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269.exe File opened (read-only) \??\F: fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269.exe File opened (read-only) \??\G: fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269.exe File opened (read-only) \??\H: fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269.exe File opened (read-only) \??\M: fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269.exe File opened (read-only) \??\N: fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269.exe File opened (read-only) \??\W: fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269.exe File opened (read-only) \??\I: fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269.exe File opened (read-only) \??\L: fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269.exe File opened (read-only) \??\Q: fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269.exe File opened (read-only) \??\S: fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269.exe File opened (read-only) \??\X: fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269.exe File opened (read-only) \??\J: fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269.exe File opened (read-only) \??\K: fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269.exe File opened (read-only) \??\U: fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269.exepid process 3144 fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269.exepid process 3144 fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269.exe 3144 fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269.exe 3144 fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269.exe"C:\Users\Admin\AppData\Local\Temp\fc1a2d82186cb737431221aff6f4b81ccb2e6d6eb1ab62bd14677c6055c51269.exe"1⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx