Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
31-08-2023 02:57
Static task
static1
Behavioral task
behavioral1
Sample
1ae5034bae4797e77052da0d6ca9e4d2c74bc5daf2ca71fe9b21dbf0f628cb99.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
1ae5034bae4797e77052da0d6ca9e4d2c74bc5daf2ca71fe9b21dbf0f628cb99.exe
Resource
win10v2004-20230703-en
General
-
Target
1ae5034bae4797e77052da0d6ca9e4d2c74bc5daf2ca71fe9b21dbf0f628cb99.exe
-
Size
2.7MB
-
MD5
ff32adecc7630df9c55b4b546e0a6edb
-
SHA1
3555e3a29e01586569c01bf27507eb48caf45402
-
SHA256
1ae5034bae4797e77052da0d6ca9e4d2c74bc5daf2ca71fe9b21dbf0f628cb99
-
SHA512
68bf7081394019fd18ac4b3273cd1b4305d1d8619076ea23884e475c62050d29644eeb6d123169b4c121e5ee93a3474241356c62a0d9d9bb2689a725b43a2c4c
-
SSDEEP
49152:4X7ZP62Sl6fiyRbVzW0+8HDxAQwzx6AaHPkOI4ftdD:01P6J6ayRbVK0+Gw5sPkat9
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1980-13-0x0000000010000000-0x00000000105A1000-memory.dmp upx behavioral1/memory/1980-14-0x0000000010000000-0x00000000105A1000-memory.dmp upx behavioral1/memory/1980-15-0x0000000010000000-0x00000000105A1000-memory.dmp upx behavioral1/memory/1980-16-0x0000000010000000-0x00000000105A1000-memory.dmp upx behavioral1/memory/1980-17-0x0000000010000000-0x00000000105A1000-memory.dmp upx behavioral1/memory/1980-18-0x0000000010000000-0x00000000105A1000-memory.dmp upx behavioral1/memory/1980-19-0x0000000010000000-0x00000000105A1000-memory.dmp upx -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1980 1ae5034bae4797e77052da0d6ca9e4d2c74bc5daf2ca71fe9b21dbf0f628cb99.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1980 1ae5034bae4797e77052da0d6ca9e4d2c74bc5daf2ca71fe9b21dbf0f628cb99.exe 1980 1ae5034bae4797e77052da0d6ca9e4d2c74bc5daf2ca71fe9b21dbf0f628cb99.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ae5034bae4797e77052da0d6ca9e4d2c74bc5daf2ca71fe9b21dbf0f628cb99.exe"C:\Users\Admin\AppData\Local\Temp\1ae5034bae4797e77052da0d6ca9e4d2c74bc5daf2ca71fe9b21dbf0f628cb99.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1980