Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
25-08-2023 20:29
Static task
static1
Behavioral task
behavioral1
Sample
75097ece457a1d966c411d6f2a7b945fa6c8cb22f95e63f394872d368bc228e5.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
75097ece457a1d966c411d6f2a7b945fa6c8cb22f95e63f394872d368bc228e5.exe
Resource
win10v2004-20230703-en
General
-
Target
75097ece457a1d966c411d6f2a7b945fa6c8cb22f95e63f394872d368bc228e5.exe
-
Size
1.2MB
-
MD5
8041f24c6dfca5242e7a7a98c34c91f4
-
SHA1
960b669f7fa4bd28e2c1f07e6d84c949441eb504
-
SHA256
75097ece457a1d966c411d6f2a7b945fa6c8cb22f95e63f394872d368bc228e5
-
SHA512
41e349129dc8d171905e140489b426cec949a50ede80399bd19cd407712cb0a9e5194703b4d7dadc58a40b7405f6f546565f705c322133b7ae2517154a4fac44
-
SSDEEP
24576:nAfjT/yriGf5t5emhtM74h16OLsC4kVzrSyovnmorhfVu+tgqIsXqA:wjTKrtxtAGtM74rVfUtvFfrxqA
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2264 svchost.exe -
resource yara_rule behavioral2/memory/5040-3-0x0000000010000000-0x000000001001E000-memory.dmp upx behavioral2/memory/5040-5-0x00000000025C0000-0x00000000025CB000-memory.dmp upx behavioral2/memory/2264-12-0x0000000010000000-0x000000001001E000-memory.dmp upx behavioral2/memory/2264-14-0x00000000027D0000-0x00000000027DB000-memory.dmp upx behavioral2/memory/5040-16-0x00000000025C0000-0x00000000025CB000-memory.dmp upx behavioral2/memory/2264-18-0x0000000010000000-0x000000001001E000-memory.dmp upx behavioral2/memory/2264-20-0x00000000027D0000-0x00000000027DB000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe 2264 svchost.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 5040 75097ece457a1d966c411d6f2a7b945fa6c8cb22f95e63f394872d368bc228e5.exe 5040 75097ece457a1d966c411d6f2a7b945fa6c8cb22f95e63f394872d368bc228e5.exe 2264 svchost.exe 2264 svchost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5040 wrote to memory of 2264 5040 75097ece457a1d966c411d6f2a7b945fa6c8cb22f95e63f394872d368bc228e5.exe 85 PID 5040 wrote to memory of 2264 5040 75097ece457a1d966c411d6f2a7b945fa6c8cb22f95e63f394872d368bc228e5.exe 85 PID 5040 wrote to memory of 2264 5040 75097ece457a1d966c411d6f2a7b945fa6c8cb22f95e63f394872d368bc228e5.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\75097ece457a1d966c411d6f2a7b945fa6c8cb22f95e63f394872d368bc228e5.exe"C:\Users\Admin\AppData\Local\Temp\75097ece457a1d966c411d6f2a7b945fa6c8cb22f95e63f394872d368bc228e5.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5040 -
F:\svchost.exeF:\svchost.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2264
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD58041f24c6dfca5242e7a7a98c34c91f4
SHA1960b669f7fa4bd28e2c1f07e6d84c949441eb504
SHA25675097ece457a1d966c411d6f2a7b945fa6c8cb22f95e63f394872d368bc228e5
SHA51241e349129dc8d171905e140489b426cec949a50ede80399bd19cd407712cb0a9e5194703b4d7dadc58a40b7405f6f546565f705c322133b7ae2517154a4fac44
-
Filesize
1.2MB
MD58041f24c6dfca5242e7a7a98c34c91f4
SHA1960b669f7fa4bd28e2c1f07e6d84c949441eb504
SHA25675097ece457a1d966c411d6f2a7b945fa6c8cb22f95e63f394872d368bc228e5
SHA51241e349129dc8d171905e140489b426cec949a50ede80399bd19cd407712cb0a9e5194703b4d7dadc58a40b7405f6f546565f705c322133b7ae2517154a4fac44