902f79c02384f29da0f6f3ad0efb01d3ff8cf88069539651a5c8a020143f82f5 | Triage

Analysis

max time kernel
2s
max time network
20s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18-08-2023 21:59

Sharing

Report Analysis Logs

General

Target

aida64.exe
Size

11.5MB
MD5

0eccc7b0caa26d155487cbbe50f1351f
SHA1

cd0c58df38b0e330d3b5c81d8e2b76e5ab391d4c
SHA256

902f79c02384f29da0f6f3ad0efb01d3ff8cf88069539651a5c8a020143f82f5
SHA512

b7d6e1fde662ea1748a8b7e9a63b18fa206807c5dbe8c97584ec995e10ef7219e0522461f174e02147203c715aa80a93208796d66524f1bef29fbeeb82807dab
SSDEEP

196608:im7c9NyhdagWzdYV0kP39PKkX6lLzHf7zMr9bfl+110N5L7ht4w:iZN/gWmSPlLz/4O1GjL9Sw

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\INF\c_monitor.PNF	aida64.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3728	aida64.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3728	aida64.exe

C:\Users\Admin\AppData\Local\Temp\aida64.exe
"C:\Users\Admin\AppData\Local\Temp\aida64.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3728-133-0x00000000050B0000-0x00000000050B1000-memory.dmp

Filesize
4KB

Download
memory/3728-134-0x000000000E100000-0x000000000E101000-memory.dmp

Filesize
4KB

Download