Analysis
-
max time kernel
1s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
05-07-2023 19:11
Static task
static1
Behavioral task
behavioral1
Sample
1dee41eb3da7edexeexeexeex.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
1dee41eb3da7edexeexeexeex.exe
Resource
win10v2004-20230703-en
General
-
Target
1dee41eb3da7edexeexeexeex.exe
-
Size
373KB
-
MD5
1dee41eb3da7ed1f50b5c2721c7ba52a
-
SHA1
6256c08f7046ba1ee52d9b405941b4861fdca879
-
SHA256
97deed66d17065adf79e77e13e792e9b7273cb8c0ddb525ce1d68efc5a9c4c44
-
SHA512
bb73ccb93b441df9bd243aab2ca1eb6c62bc53ce7ca37fdb534d2782dc013fc1cbf46a8c034e6ddfb69b20e707efc69c62ef264fb4bc0c34cde3b5f2d5b6002b
-
SSDEEP
6144:CplrlbbDdQaqd2X/96fr3KFEUGjr8uB2WgcA0cpXEVNrvGZ4FUqm6:CplrVbDdQaqdS/ofraFErH8uB2Wm0SXj
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1728 runtime.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\compact\runtime.exe 1dee41eb3da7edexeexeexeex.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4868 1dee41eb3da7edexeexeexeex.exe 4868 1dee41eb3da7edexeexeexeex.exe 4868 1dee41eb3da7edexeexeexeex.exe 4868 1dee41eb3da7edexeexeexeex.exe 1728 runtime.exe 1728 runtime.exe 1728 runtime.exe 1728 runtime.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4868 wrote to memory of 1728 4868 1dee41eb3da7edexeexeexeex.exe 79 PID 4868 wrote to memory of 1728 4868 1dee41eb3da7edexeexeexeex.exe 79 PID 4868 wrote to memory of 1728 4868 1dee41eb3da7edexeexeexeex.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\1dee41eb3da7edexeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\1dee41eb3da7edexeexeexeex.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Program Files\compact\runtime.exe"C:\Program Files\compact\runtime.exe" "33201"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1728
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
374KB
MD5378c5b306f994e746ba7f82cb6d2a44c
SHA1c929757387c37a86687cb4d8ff3214bc84dbc319
SHA256e7c65d31f43d7ceba3106617eac4097ed856c82e6ca889c31d72249dca5941b0
SHA512a0ddb5d8a4777bb6731cd345b38322b054c1bf0cd18b4eff83aed21a2534c65246dfb9edda05b63bc1bbb277cba2c33d2487b6da6812b4bfd30e9eefc8afa055
-
Filesize
374KB
MD5378c5b306f994e746ba7f82cb6d2a44c
SHA1c929757387c37a86687cb4d8ff3214bc84dbc319
SHA256e7c65d31f43d7ceba3106617eac4097ed856c82e6ca889c31d72249dca5941b0
SHA512a0ddb5d8a4777bb6731cd345b38322b054c1bf0cd18b4eff83aed21a2534c65246dfb9edda05b63bc1bbb277cba2c33d2487b6da6812b4bfd30e9eefc8afa055