Analysis
-
max time kernel
143s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
16-07-2023 11:17
Static task
static1
Behavioral task
behavioral1
Sample
68735786d42326_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
68735786d42326_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
68735786d42326_JC.exe
-
Size
407KB
-
MD5
68735786d4232691b40267794c1a6fe1
-
SHA1
80f09cf6b48c0ee657c733e16cae7de460046448
-
SHA256
8ed238d70f1b440c9522734bcd84fbd6ee724ad7cba8db686ec76bbe870c4b43
-
SHA512
cb9de54a1dc3ad9726e49e5cc6d80c57e50ab53b11aa1badd506aa9067c2af5e3fe0fe5762f63804fe2f0a46079e57bb803345f942ac0754cb82a157cc0f8d16
-
SSDEEP
12288:DplrVbDdQaqdS/ofraFErH8uB2Wm0SXsNr5FU:FxRQ+Fucuvm0as
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4708 development.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\approach\development.exe 68735786d42326_JC.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2968 68735786d42326_JC.exe 2968 68735786d42326_JC.exe 2968 68735786d42326_JC.exe 2968 68735786d42326_JC.exe 4708 development.exe 4708 development.exe 4708 development.exe 4708 development.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2968 wrote to memory of 4708 2968 68735786d42326_JC.exe 86 PID 2968 wrote to memory of 4708 2968 68735786d42326_JC.exe 86 PID 2968 wrote to memory of 4708 2968 68735786d42326_JC.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\68735786d42326_JC.exe"C:\Users\Admin\AppData\Local\Temp\68735786d42326_JC.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Program Files\approach\development.exe"C:\Program Files\approach\development.exe" "33201"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4708
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
407KB
MD563a5c1ab04ac7dc871ddd7ee8c326efd
SHA15bc1adcde3dfec6d1b7071e16a2a2dbcbea1e7f5
SHA256c6b9d9b0a77d311e0857f46ee40dc5be151c1c015893bc5de94f18a913369a1d
SHA5122d79d297c0267a781a081189a1ee6970dc3d649d8aaa86f990a0b82bb29e185dd382031e3fa61396f9d8e584be6f701f97bbd11518684fe5aed27353ef1fff0a
-
Filesize
407KB
MD563a5c1ab04ac7dc871ddd7ee8c326efd
SHA15bc1adcde3dfec6d1b7071e16a2a2dbcbea1e7f5
SHA256c6b9d9b0a77d311e0857f46ee40dc5be151c1c015893bc5de94f18a913369a1d
SHA5122d79d297c0267a781a081189a1ee6970dc3d649d8aaa86f990a0b82bb29e185dd382031e3fa61396f9d8e584be6f701f97bbd11518684fe5aed27353ef1fff0a