Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
19-07-2023 14:39
Static task
static1
Behavioral task
behavioral1
Sample
ee4d31db38990dexe_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
ee4d31db38990dexe_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
ee4d31db38990dexe_JC.exe
-
Size
238KB
-
MD5
ee4d31db38990d11d4a670244c49e13d
-
SHA1
ddf4135a4826bd696e75c9f2d9a77ca419044545
-
SHA256
194932822024a44c9d843827883d5e44803fb49c891581d3f8bef83090ea1a9c
-
SHA512
50aa33223b9d3b78079492bcc81c96a0a7c1fd7294c100eee8cbd37cd78c88d47f8f5e3e9fb5d49b75afe5f8a9064338bb9d34e7f5e414d5e0f20647cf7c3262
-
SSDEEP
3072:lxUm75Fku3eKeO213SJReOqdmErj+HyHnNVIPL/+ybbiW1u46Q7qV3lU8xM:fU8Dk11CJ1qDWUNVIT/bblS9x
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1968 customer.exe -
Loads dropped DLL 2 IoCs
pid Process 2612 ee4d31db38990dexe_JC.exe 2612 ee4d31db38990dexe_JC.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\require\customer.exe ee4d31db38990dexe_JC.exe File opened for modification C:\Program Files\require\customer.exe ee4d31db38990dexe_JC.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2612 ee4d31db38990dexe_JC.exe 2612 ee4d31db38990dexe_JC.exe 2612 ee4d31db38990dexe_JC.exe 2612 ee4d31db38990dexe_JC.exe 1968 customer.exe 1968 customer.exe 1968 customer.exe 1968 customer.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2612 wrote to memory of 1968 2612 ee4d31db38990dexe_JC.exe 28 PID 2612 wrote to memory of 1968 2612 ee4d31db38990dexe_JC.exe 28 PID 2612 wrote to memory of 1968 2612 ee4d31db38990dexe_JC.exe 28 PID 2612 wrote to memory of 1968 2612 ee4d31db38990dexe_JC.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee4d31db38990dexe_JC.exe"C:\Users\Admin\AppData\Local\Temp\ee4d31db38990dexe_JC.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Program Files\require\customer.exe"C:\Program Files\require\customer.exe" "33201"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1968
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
238KB
MD58a5f88d61aa630dff25acf16d8a0760b
SHA11eb1eb7bab0b6e7d9f80e70cb6b95ee4edee3772
SHA256d061c3961c7b48689aa3c6b48527738455bab8715efad8a1d679589cd3b81491
SHA5127d9854dd6399321b31522f47235848fcc79a378524b3681fefb538ec469a72a44c2a577da7aadadc494e643b22fc4b6327bd01ceb59ae2d356ba6b5f039daddf
-
Filesize
238KB
MD58a5f88d61aa630dff25acf16d8a0760b
SHA11eb1eb7bab0b6e7d9f80e70cb6b95ee4edee3772
SHA256d061c3961c7b48689aa3c6b48527738455bab8715efad8a1d679589cd3b81491
SHA5127d9854dd6399321b31522f47235848fcc79a378524b3681fefb538ec469a72a44c2a577da7aadadc494e643b22fc4b6327bd01ceb59ae2d356ba6b5f039daddf
-
Filesize
238KB
MD58a5f88d61aa630dff25acf16d8a0760b
SHA11eb1eb7bab0b6e7d9f80e70cb6b95ee4edee3772
SHA256d061c3961c7b48689aa3c6b48527738455bab8715efad8a1d679589cd3b81491
SHA5127d9854dd6399321b31522f47235848fcc79a378524b3681fefb538ec469a72a44c2a577da7aadadc494e643b22fc4b6327bd01ceb59ae2d356ba6b5f039daddf
-
Filesize
238KB
MD58a5f88d61aa630dff25acf16d8a0760b
SHA11eb1eb7bab0b6e7d9f80e70cb6b95ee4edee3772
SHA256d061c3961c7b48689aa3c6b48527738455bab8715efad8a1d679589cd3b81491
SHA5127d9854dd6399321b31522f47235848fcc79a378524b3681fefb538ec469a72a44c2a577da7aadadc494e643b22fc4b6327bd01ceb59ae2d356ba6b5f039daddf