Analysis
-
max time kernel
139s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
06-07-2023 21:07
Static task
static1
Behavioral task
behavioral1
Sample
03d1ccb2ae562c3c14549539a41813b9903a46d7942a7718dd591e46f6d53fde.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
03d1ccb2ae562c3c14549539a41813b9903a46d7942a7718dd591e46f6d53fde.exe
Resource
win10v2004-20230703-en
General
-
Target
03d1ccb2ae562c3c14549539a41813b9903a46d7942a7718dd591e46f6d53fde.exe
-
Size
1008KB
-
MD5
a0d38eba78e40a75062aaee851ce0736
-
SHA1
ed08545fe30260fa31395987b2e47498e732f201
-
SHA256
03d1ccb2ae562c3c14549539a41813b9903a46d7942a7718dd591e46f6d53fde
-
SHA512
dc3098ceb2886b21d33b8739f4eab97eb9d1f51a6e808a2e6ea0a24b870d2f631a3ccd7f21c1543ca31819674c1bd0982a76bf231d3449363a5554e5b3376ab4
-
SSDEEP
12288:FTk242zweAmpc3rBs53qugxBywpnj5wX/sj92tbVRVhXR5nWFpPoSfgUFr/RFkI+:FT1zRDpEr656JxBywpnjqPRtyb1RJ1a
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4404-133-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4404-134-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4404-135-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4404-137-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4404-139-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4404-141-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4404-143-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4404-145-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4404-147-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4404-149-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4404-153-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4404-151-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4404-157-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4404-155-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4404-160-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4404-164-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4404-162-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4404-166-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4404-168-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4404-170-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4404-172-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4404-176-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4404-174-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4404-177-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4404 03d1ccb2ae562c3c14549539a41813b9903a46d7942a7718dd591e46f6d53fde.exe 4404 03d1ccb2ae562c3c14549539a41813b9903a46d7942a7718dd591e46f6d53fde.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4404 03d1ccb2ae562c3c14549539a41813b9903a46d7942a7718dd591e46f6d53fde.exe 4404 03d1ccb2ae562c3c14549539a41813b9903a46d7942a7718dd591e46f6d53fde.exe 4404 03d1ccb2ae562c3c14549539a41813b9903a46d7942a7718dd591e46f6d53fde.exe 4404 03d1ccb2ae562c3c14549539a41813b9903a46d7942a7718dd591e46f6d53fde.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\03d1ccb2ae562c3c14549539a41813b9903a46d7942a7718dd591e46f6d53fde.exe"C:\Users\Admin\AppData\Local\Temp\03d1ccb2ae562c3c14549539a41813b9903a46d7942a7718dd591e46f6d53fde.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4404