Analysis

  • max time kernel
    141s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    08/10/2023, 10:17

General

  • Target

    5337ab4138a7bdf92d8aa3d7c66c6a47e09d780a18a1e11a315d1be01ee07a5a.exe

  • Size

    3.2MB

  • MD5

    6ab2bb93deebdfb03b5805464df77034

  • SHA1

    1a03f8deda4b7d09a8232e06ebc35f329b2697f2

  • SHA256

    5337ab4138a7bdf92d8aa3d7c66c6a47e09d780a18a1e11a315d1be01ee07a5a

  • SHA512

    1a19864f5c7f4a57434d34c9bb19817b9f2cfffbbc09601cc871ff8cb1a2c5e7e2f57612fe5e759dbc735c96a1fe915938550ea84b2e7a3c086c040e5ebd5bfe

  • SSDEEP

    98304:glzdLtqYzXPglMeVQ7yMvHhGp4xwHc5mwR1bZ:glTdDglyZGpgv5mC1bZ

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5337ab4138a7bdf92d8aa3d7c66c6a47e09d780a18a1e11a315d1be01ee07a5a.exe
    "C:\Users\Admin\AppData\Local\Temp\5337ab4138a7bdf92d8aa3d7c66c6a47e09d780a18a1e11a315d1be01ee07a5a.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\ExuiKrnln_Win32_20230911.lib

    Filesize

    1.6MB

    MD5

    031ad1ecd93701d39265771942ec716c

    SHA1

    cb3ef507bf0e848894fbb96a29bfc94a0c302152

    SHA256

    9a7fde2ea7883701bf858e0daef74d787a31c3cbd9f1171cec0a3a382ee9e6ba

    SHA512

    374dab32b6304834c7acd8b5e6701ece016bf57d3abdd416ef2b63f7cbda24c9e59f9dfc27b6823ac6256bbab38aace74334dec7d57f1ef6cb9b80c239003bae

  • memory/1728-13-0x0000000000400000-0x0000000000BE4000-memory.dmp

    Filesize

    7.9MB

  • memory/1728-14-0x0000000000400000-0x0000000000BE4000-memory.dmp

    Filesize

    7.9MB

  • memory/1728-6-0x0000000010000000-0x0000000010059000-memory.dmp

    Filesize

    356KB

  • memory/1728-0-0x0000000000400000-0x0000000000BE4000-memory.dmp

    Filesize

    7.9MB

  • memory/1728-8-0x0000000000400000-0x0000000000BE4000-memory.dmp

    Filesize

    7.9MB

  • memory/1728-9-0x0000000000400000-0x0000000000BE4000-memory.dmp

    Filesize

    7.9MB

  • memory/1728-10-0x0000000000400000-0x0000000000BE4000-memory.dmp

    Filesize

    7.9MB

  • memory/1728-11-0x0000000000400000-0x0000000000BE4000-memory.dmp

    Filesize

    7.9MB

  • memory/1728-1-0x0000000000230000-0x0000000000233000-memory.dmp

    Filesize

    12KB

  • memory/1728-12-0x0000000000400000-0x0000000000BE4000-memory.dmp

    Filesize

    7.9MB

  • memory/1728-7-0x0000000000390000-0x00000000003E9000-memory.dmp

    Filesize

    356KB

  • memory/1728-15-0x0000000000400000-0x0000000000BE4000-memory.dmp

    Filesize

    7.9MB

  • memory/1728-16-0x0000000000400000-0x0000000000BE4000-memory.dmp

    Filesize

    7.9MB

  • memory/1728-17-0x0000000000400000-0x0000000000BE4000-memory.dmp

    Filesize

    7.9MB

  • memory/1728-18-0x0000000000400000-0x0000000000BE4000-memory.dmp

    Filesize

    7.9MB

  • memory/1728-19-0x0000000000400000-0x0000000000BE4000-memory.dmp

    Filesize

    7.9MB

  • memory/1728-20-0x0000000000400000-0x0000000000BE4000-memory.dmp

    Filesize

    7.9MB

  • memory/1728-21-0x0000000000400000-0x0000000000BE4000-memory.dmp

    Filesize

    7.9MB

  • memory/1728-22-0x0000000000400000-0x0000000000BE4000-memory.dmp

    Filesize

    7.9MB