Analysis
-
max time kernel
117s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
25/08/2023, 07:51
Static task
static1
Behavioral task
behavioral1
Sample
934e01e5eebcf843a6556c5bde7b7404f199f999261d54c72c602bc65992b35d.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
934e01e5eebcf843a6556c5bde7b7404f199f999261d54c72c602bc65992b35d.exe
Resource
win10v2004-20230703-en
General
-
Target
934e01e5eebcf843a6556c5bde7b7404f199f999261d54c72c602bc65992b35d.exe
-
Size
4.2MB
-
MD5
caf0903d97bab68125fe4e825483afb6
-
SHA1
5f9f17cecc4c4e3b6fd4328cad579d7f2c9d24b8
-
SHA256
934e01e5eebcf843a6556c5bde7b7404f199f999261d54c72c602bc65992b35d
-
SHA512
ab117b932528a40e35d78cc8235e8868ac5830aeea6fd365dbc4d5bbabaada03a856ba0d5ec8be2f825c1df0dadc5261a5767443da3282dde3be610015a6aa8c
-
SSDEEP
98304:ydh5q7noS9h6mvDrQqBZm5LJKdzOJDb4v+y7:yZqNvQk+L0wN0v+
Malware Config
Signatures
-
Downloads MZ/PE file
-
Loads dropped DLL 2 IoCs
pid Process 2544 934e01e5eebcf843a6556c5bde7b7404f199f999261d54c72c602bc65992b35d.exe 2544 934e01e5eebcf843a6556c5bde7b7404f199f999261d54c72c602bc65992b35d.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2544 934e01e5eebcf843a6556c5bde7b7404f199f999261d54c72c602bc65992b35d.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2544 934e01e5eebcf843a6556c5bde7b7404f199f999261d54c72c602bc65992b35d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\934e01e5eebcf843a6556c5bde7b7404f199f999261d54c72c602bc65992b35d.exe"C:\Users\Admin\AppData\Local\Temp\934e01e5eebcf843a6556c5bde7b7404f199f999261d54c72c602bc65992b35d.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2544
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD566d9cea97a1834d1b80a6d7689fb33de
SHA12efec90f47a83cef3579cc2b847c364789c6644f
SHA256a5eee2aed477cdd096dd201952a7374aa0b6d062758ddc0cc18be999891fd137
SHA51281073176f73509c9baa30218e4e00527d5dcc10c11e4d55345c525c52965672356b3b265e4fe590e023ddf9cb088b3b19e75bc98d66867127fdd48b7ab7a6fa1
-
Filesize
2KB
MD5e178e5669d5b20ca4b93203bc86a1892
SHA1ad15e47b018f14a948fd4b1bbcdae35eeecd1c41
SHA256a53b213010f3fbbfda804a40263f6cd85fd80979c00542d31f8abbf52225ef96
SHA5122377792de101a4e41abd9829c96ecca261b008ffec84c1b6c56fd3ecaaffae7ea04ab962550e36f6d55138ba08bf67722eb2e19899d16fc352b54457d321a8a8
-
Filesize
9KB
MD51a69a52ee1a84c6d241d0a557997b6a8
SHA19c44f01c1816714aa32f6f961518478910db0167
SHA2561567ae2b8b6c31b40c2d1c92de98efe7414f65e01cdbf61e8d33e9eef17db849
SHA51211b4003dba70db88524d76185627d1d94c6f0aaf8f5e0b7569ab37e96b4bde613e49bed86282046ede19a82099b83c61ab8df7eecd984bce079d10e44b768371
-
Filesize
38B
MD57290507d1784243dc2e97e2c38b7a8b3
SHA13b24cdd91ed1d3142e475f487b203866781a4763
SHA2562770ff44751e94474d639cb09cbadaffac40138bab16a4f27a61a63ca58ba4d4
SHA5129fdaf7d4b9d8a16abd421e931edb52667c6430ce7e2052b30862a30a87bf8b68fbdf6b3a4f522a6e28da90995d3d8293b9b6876c980272dcb9ae1c53b82ca159
-
Filesize
129.8MB
MD551a534ddfddb68c31a1ba04aa86d5e6d
SHA125a12cdb763d5cde3d7cfc2717c84a9c9e99c130
SHA256c54ee5e9df39d78f2cd3fd6881e420e6d56c317b1aabf869686c6c40f9981b71
SHA5121f206ad90ed780f65431068da1287dd2201fc5610bda669d3eaaecae48a85d1abd995ca32a6178c7ae1190c552c1eb328f44e0c0fe9cec4099f6f2fcf69b5548
-
Filesize
129.8MB
MD551a534ddfddb68c31a1ba04aa86d5e6d
SHA125a12cdb763d5cde3d7cfc2717c84a9c9e99c130
SHA256c54ee5e9df39d78f2cd3fd6881e420e6d56c317b1aabf869686c6c40f9981b71
SHA5121f206ad90ed780f65431068da1287dd2201fc5610bda669d3eaaecae48a85d1abd995ca32a6178c7ae1190c552c1eb328f44e0c0fe9cec4099f6f2fcf69b5548