Analysis
-
max time kernel
117s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
05/08/2023, 11:25
Static task
static1
Behavioral task
behavioral1
Sample
4cc818f6c7825970556f87b1c8e0032683a9b83b1e7c233cdcfce7a0f5f32438.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
4cc818f6c7825970556f87b1c8e0032683a9b83b1e7c233cdcfce7a0f5f32438.exe
Resource
win10v2004-20230703-en
General
-
Target
4cc818f6c7825970556f87b1c8e0032683a9b83b1e7c233cdcfce7a0f5f32438.exe
-
Size
4.9MB
-
MD5
1b1e806224a962a88c83af544496a3c5
-
SHA1
c5f8e386a4349328aa971377e1a4babfb90cbcab
-
SHA256
4cc818f6c7825970556f87b1c8e0032683a9b83b1e7c233cdcfce7a0f5f32438
-
SHA512
c886a8a5b60830c34469bff9faa3377f62789119d262acc5ef62db7c71527e5a0d8f124e3fa8e988cd7aef6f88c70b17988b30f29c14558ebae7576c43f97569
-
SSDEEP
98304:LxCkjfzIsvWIXlG4F945SbWf+YFCWpA1k4DYgAAvAF6RKz91PM+l:Lgk4oWIsQaf+HWK1k4sgKkKz9m+l
Malware Config
Signatures
-
resource yara_rule behavioral1/files/0x0009000000012029-58.dat upx behavioral1/memory/2256-1054-0x00000000003C0000-0x00000000003FE000-memory.dmp upx behavioral1/memory/2256-1056-0x00000000003C0000-0x00000000003FE000-memory.dmp upx behavioral1/memory/2256-1058-0x00000000003C0000-0x00000000003FE000-memory.dmp upx behavioral1/memory/2256-1057-0x00000000003C0000-0x00000000003FE000-memory.dmp upx behavioral1/memory/2256-1060-0x00000000003C0000-0x00000000003FE000-memory.dmp upx behavioral1/memory/2256-1059-0x00000000003C0000-0x00000000003FE000-memory.dmp upx behavioral1/memory/2256-1062-0x00000000003C0000-0x00000000003FE000-memory.dmp upx behavioral1/memory/2256-1066-0x00000000003C0000-0x00000000003FE000-memory.dmp upx behavioral1/memory/2256-1064-0x00000000003C0000-0x00000000003FE000-memory.dmp upx behavioral1/memory/2256-1069-0x00000000003C0000-0x00000000003FE000-memory.dmp upx behavioral1/memory/2256-1071-0x00000000003C0000-0x00000000003FE000-memory.dmp upx behavioral1/memory/2256-1075-0x00000000003C0000-0x00000000003FE000-memory.dmp upx behavioral1/memory/2256-1073-0x00000000003C0000-0x00000000003FE000-memory.dmp upx behavioral1/memory/2256-1078-0x00000000003C0000-0x00000000003FE000-memory.dmp upx behavioral1/memory/2256-1080-0x00000000003C0000-0x00000000003FE000-memory.dmp upx behavioral1/memory/2256-1083-0x00000000003C0000-0x00000000003FE000-memory.dmp upx behavioral1/memory/2256-1085-0x00000000003C0000-0x00000000003FE000-memory.dmp upx behavioral1/memory/2256-1089-0x00000000003C0000-0x00000000003FE000-memory.dmp upx behavioral1/memory/2256-1091-0x00000000003C0000-0x00000000003FE000-memory.dmp upx behavioral1/memory/2256-1087-0x00000000003C0000-0x00000000003FE000-memory.dmp upx behavioral1/memory/2256-1093-0x00000000003C0000-0x00000000003FE000-memory.dmp upx behavioral1/memory/2256-1095-0x00000000003C0000-0x00000000003FE000-memory.dmp upx behavioral1/memory/2256-1099-0x00000000003C0000-0x00000000003FE000-memory.dmp upx behavioral1/memory/2256-1097-0x00000000003C0000-0x00000000003FE000-memory.dmp upx behavioral1/memory/2256-1101-0x00000000003C0000-0x00000000003FE000-memory.dmp upx behavioral1/memory/2256-1103-0x00000000003C0000-0x00000000003FE000-memory.dmp upx behavioral1/memory/2256-1104-0x00000000003C0000-0x00000000003FE000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2256 4cc818f6c7825970556f87b1c8e0032683a9b83b1e7c233cdcfce7a0f5f32438.exe 2256 4cc818f6c7825970556f87b1c8e0032683a9b83b1e7c233cdcfce7a0f5f32438.exe 2256 4cc818f6c7825970556f87b1c8e0032683a9b83b1e7c233cdcfce7a0f5f32438.exe 2256 4cc818f6c7825970556f87b1c8e0032683a9b83b1e7c233cdcfce7a0f5f32438.exe 2256 4cc818f6c7825970556f87b1c8e0032683a9b83b1e7c233cdcfce7a0f5f32438.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2256 4cc818f6c7825970556f87b1c8e0032683a9b83b1e7c233cdcfce7a0f5f32438.exe 2256 4cc818f6c7825970556f87b1c8e0032683a9b83b1e7c233cdcfce7a0f5f32438.exe 2256 4cc818f6c7825970556f87b1c8e0032683a9b83b1e7c233cdcfce7a0f5f32438.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4cc818f6c7825970556f87b1c8e0032683a9b83b1e7c233cdcfce7a0f5f32438.exe"C:\Users\Admin\AppData\Local\Temp\4cc818f6c7825970556f87b1c8e0032683a9b83b1e7c233cdcfce7a0f5f32438.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2256
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
384KB
MD5abe62e93ae2513d178ea5a99aefd2caa
SHA154857d7995e4b078e9ce2e45fade0848ba96ce3d
SHA2566e64d442ef3b0c9efa7f599b08b2133eaa7586526f7525195f6a635f8f80974a
SHA512a7029490566065727bd072e8c066fd0b744c421817e44cb782bdaf59d3821eabfa7807db5b30eb54aeca12c422eba46ba8082db79577e123b98b92d162f9c1c2