Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
05/07/2023, 20:07
Static task
static1
Behavioral task
behavioral1
Sample
1f069ff8c1e1eaexeexeexeex.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
1f069ff8c1e1eaexeexeexeex.exe
Resource
win10v2004-20230703-en
General
-
Target
1f069ff8c1e1eaexeexeexeex.exe
-
Size
373KB
-
MD5
1f069ff8c1e1eadf130965de4297fabf
-
SHA1
6ee705d2448b5e1ea295fa6eb3f9f6f4a29adad3
-
SHA256
095eaf3dad26368e43384d8758a15e0baf77f96b7e1cda07a3cc83ee66650bf8
-
SHA512
c0119158dec6fb012862155d71685219523df7ec68a6d4f035542f12c7c3d36caf90d85c02f26749dac84ccfc1752d4ff78b08239f9ef38478e138cee722e96b
-
SSDEEP
6144:nplrlbbDdQaqd2X/96fr3KFEUGjr8uB2WgcA0cpXEVNrvGZ4FUqm6:nplrVbDdQaqdS/ofraFErH8uB2Wm0SXj
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4152 Dependency.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Size\Dependency.exe 1f069ff8c1e1eaexeexeexeex.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4268 1f069ff8c1e1eaexeexeexeex.exe 4268 1f069ff8c1e1eaexeexeexeex.exe 4268 1f069ff8c1e1eaexeexeexeex.exe 4268 1f069ff8c1e1eaexeexeexeex.exe 4152 Dependency.exe 4152 Dependency.exe 4152 Dependency.exe 4152 Dependency.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4268 wrote to memory of 4152 4268 1f069ff8c1e1eaexeexeexeex.exe 85 PID 4268 wrote to memory of 4152 4268 1f069ff8c1e1eaexeexeexeex.exe 85 PID 4268 wrote to memory of 4152 4268 1f069ff8c1e1eaexeexeexeex.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f069ff8c1e1eaexeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\1f069ff8c1e1eaexeexeexeex.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Program Files\Size\Dependency.exe"C:\Program Files\Size\Dependency.exe" "33201"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4152
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
373KB
MD5ad3e013672c3306ec2a9b1cbd366ce2f
SHA1f13d0d69a45e6f986f53dd4f182de9389f979fdd
SHA25616e06437d4a64718dcca799aebce0da03b050a9b334b28aa18f18aa15b478a5b
SHA512645d5699656a1c64431174bfd9ebb900ac1803cb45a6999bacdda5a19cfa4d75f355340749d122ac6d8c091aa75e2056fc4dfbda9198d276712c885682f762b9
-
Filesize
373KB
MD5ad3e013672c3306ec2a9b1cbd366ce2f
SHA1f13d0d69a45e6f986f53dd4f182de9389f979fdd
SHA25616e06437d4a64718dcca799aebce0da03b050a9b334b28aa18f18aa15b478a5b
SHA512645d5699656a1c64431174bfd9ebb900ac1803cb45a6999bacdda5a19cfa4d75f355340749d122ac6d8c091aa75e2056fc4dfbda9198d276712c885682f762b9