Overview
overview
10Static
static
10gm.rar
windows7-x64
3gm.rar
windows10-2004-x64
317ffd90d20...e1.dll
windows7-x64
117ffd90d20...e1.dll
windows10-2004-x64
11caf510598...e1.exe
windows7-x64
101caf510598...e1.exe
windows10-2004-x64
11d88c47417...67.exe
windows7-x64
11d88c47417...67.exe
windows10-2004-x64
51ecb597741...af.exe
windows7-x64
1ecb597741...af.exe
windows10-2004-x64
2a5fe7d49f...b5.exe
windows7-x64
12a5fe7d49f...b5.exe
windows10-2004-x64
12c1aa4fa14...dc.exe
windows7-x64
12c1aa4fa14...dc.exe
windows10-2004-x64
134d62f47e1...6e.exe
windows7-x64
334d62f47e1...6e.exe
windows10-2004-x64
338f1b8c868...05.exe
windows7-x64
1038f1b8c868...05.exe
windows10-2004-x64
1040d8e3dae5...04.exe
windows7-x64
1040d8e3dae5...04.exe
windows10-2004-x64
10410ee08c8a...59.exe
windows7-x64
6410ee08c8a...59.exe
windows10-2004-x64
6423b7b37b1...42.exe
windows7-x64
1423b7b37b1...42.exe
windows10-2004-x64
14315b6e87c...0b.exe
windows7-x64
74315b6e87c...0b.exe
windows10-2004-x64
7453c6fe9e1...91.exe
windows7-x64
1453c6fe9e1...91.exe
windows10-2004-x64
14a841216cb...37.exe
windows7-x64
14a841216cb...37.exe
windows10-2004-x64
14e180437ef...a9.exe
windows7-x64
14e180437ef...a9.exe
windows10-2004-x64
1Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
07-09-2023 14:45
Behavioral task
behavioral1
Sample
gm.rar
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
gm.rar
Resource
win10v2004-20230831-en
Behavioral task
behavioral3
Sample
17ffd90d20cbd49c4e0d65a484eeae65a107d5bad9582afc51c4ead8bbc147e1.dll
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
17ffd90d20cbd49c4e0d65a484eeae65a107d5bad9582afc51c4ead8bbc147e1.dll
Resource
win10v2004-20230831-en
Behavioral task
behavioral5
Sample
1caf5105988781e29d93e58abcbf3bf4c973eca1a207803629bd5cf901ef5be1.exe
Resource
win7-20230831-en
Behavioral task
behavioral6
Sample
1caf5105988781e29d93e58abcbf3bf4c973eca1a207803629bd5cf901ef5be1.exe
Resource
win10v2004-20230831-en
Behavioral task
behavioral7
Sample
1d88c47417c082378c735c9e8180ea63627d5efff35852f1bb06fe6705581267.exe
Resource
win7-20230831-en
Behavioral task
behavioral8
Sample
1d88c47417c082378c735c9e8180ea63627d5efff35852f1bb06fe6705581267.exe
Resource
win10v2004-20230831-en
Behavioral task
behavioral9
Sample
1ecb59774182d0d0a04b418249428b621159838bd2bcdc1a3a7b871a65dd90af.exe
Resource
win7-20230831-en
Behavioral task
behavioral10
Sample
1ecb59774182d0d0a04b418249428b621159838bd2bcdc1a3a7b871a65dd90af.exe
Resource
win10v2004-20230831-en
Behavioral task
behavioral11
Sample
2a5fe7d49fcf65525cfbefaca92a12a0d2917d15f348a48fc7a4de7ae50776b5.exe
Resource
win7-20230831-en
Behavioral task
behavioral12
Sample
2a5fe7d49fcf65525cfbefaca92a12a0d2917d15f348a48fc7a4de7ae50776b5.exe
Resource
win10v2004-20230831-en
Behavioral task
behavioral13
Sample
2c1aa4fa14d7055f2239dbb29ab15089cb2752e9f94ec7a360d275dd607314dc.exe
Resource
win7-20230831-en
Behavioral task
behavioral14
Sample
2c1aa4fa14d7055f2239dbb29ab15089cb2752e9f94ec7a360d275dd607314dc.exe
Resource
win10v2004-20230831-en
Behavioral task
behavioral15
Sample
34d62f47e1fe45dd6309326ef696012f2473b0157e1278eea3826a95829da36e.exe
Resource
win7-20230831-en
Behavioral task
behavioral16
Sample
34d62f47e1fe45dd6309326ef696012f2473b0157e1278eea3826a95829da36e.exe
Resource
win10v2004-20230831-en
Behavioral task
behavioral17
Sample
38f1b8c86870354a31878d55c6897d7eb9e83f9418aafbfe9f6ff897dd3c2f05.exe
Resource
win7-20230831-en
Behavioral task
behavioral18
Sample
38f1b8c86870354a31878d55c6897d7eb9e83f9418aafbfe9f6ff897dd3c2f05.exe
Resource
win10v2004-20230831-en
Behavioral task
behavioral19
Sample
40d8e3dae59e911ae1cd44a03eda87d36124450287fd4f81fc095a219d8a2e04.exe
Resource
win7-20230831-en
Behavioral task
behavioral20
Sample
40d8e3dae59e911ae1cd44a03eda87d36124450287fd4f81fc095a219d8a2e04.exe
Resource
win10v2004-20230831-en
Behavioral task
behavioral21
Sample
410ee08c8a84fbb947d5f4635c95c6c8d244a51855afd4f6aa0e82dba1c38a59.exe
Resource
win7-20230831-en
Behavioral task
behavioral22
Sample
410ee08c8a84fbb947d5f4635c95c6c8d244a51855afd4f6aa0e82dba1c38a59.exe
Resource
win10v2004-20230831-en
Behavioral task
behavioral23
Sample
423b7b37b1925762c4417d81bd0f434f9760c1ed844b4b47ee7f25c8d0740242.exe
Resource
win7-20230831-en
Behavioral task
behavioral24
Sample
423b7b37b1925762c4417d81bd0f434f9760c1ed844b4b47ee7f25c8d0740242.exe
Resource
win10v2004-20230831-en
Behavioral task
behavioral25
Sample
4315b6e87c88972648fac6610116046b7af4aca6bd445839ecc8f21515591a0b.exe
Resource
win7-20230831-en
Behavioral task
behavioral26
Sample
4315b6e87c88972648fac6610116046b7af4aca6bd445839ecc8f21515591a0b.exe
Resource
win10v2004-20230831-en
Behavioral task
behavioral27
Sample
453c6fe9e176af08b176430630a4eec6f1de09f7f147248dc905dc9823af1b91.exe
Resource
win7-20230831-en
Behavioral task
behavioral28
Sample
453c6fe9e176af08b176430630a4eec6f1de09f7f147248dc905dc9823af1b91.exe
Resource
win10v2004-20230831-en
Behavioral task
behavioral29
Sample
4a841216cbbd4a587cc579434a043c17f54e3eb0e7ff615b3985411587dfa837.exe
Resource
win7-20230831-en
Behavioral task
behavioral30
Sample
4a841216cbbd4a587cc579434a043c17f54e3eb0e7ff615b3985411587dfa837.exe
Resource
win10v2004-20230831-en
Behavioral task
behavioral31
Sample
4e180437ef807b6ded234ad54f506d0cff518c980a055013871529b5905a46a9.exe
Resource
win7-20230831-en
Behavioral task
behavioral32
Sample
4e180437ef807b6ded234ad54f506d0cff518c980a055013871529b5905a46a9.exe
Resource
win10v2004-20230831-en
General
-
Target
4e180437ef807b6ded234ad54f506d0cff518c980a055013871529b5905a46a9.exe
-
Size
71KB
-
MD5
7d09bbc0aee91d29b3e62aa7889d75ac
-
SHA1
dcc48feec76915615fca1db6e2e726543fba9566
-
SHA256
4e180437ef807b6ded234ad54f506d0cff518c980a055013871529b5905a46a9
-
SHA512
3f476f40f9a17919946df05bca46d0169531fd32982cc7c62ec685aef680c2fe064361da928fb174274c88f25b64db75f9c996e271e5b3a0836aa4101649a275
-
SSDEEP
192:YKA9x8uHsLXl0Hjo7WLom8YHwOrDU0U4cbHaF55n3nN7a:YKA9WuwXl0YZm8eDr40/cuF73Za
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2588 dw20.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2828 wrote to memory of 2588 2828 4e180437ef807b6ded234ad54f506d0cff518c980a055013871529b5905a46a9.exe 28 PID 2828 wrote to memory of 2588 2828 4e180437ef807b6ded234ad54f506d0cff518c980a055013871529b5905a46a9.exe 28 PID 2828 wrote to memory of 2588 2828 4e180437ef807b6ded234ad54f506d0cff518c980a055013871529b5905a46a9.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e180437ef807b6ded234ad54f506d0cff518c980a055013871529b5905a46a9.exe"C:\Users\Admin\AppData\Local\Temp\4e180437ef807b6ded234ad54f506d0cff518c980a055013871529b5905a46a9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 8202⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2588
-