Analysis
-
max time kernel
149s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12/10/2023, 08:22
Behavioral task
behavioral1
Sample
3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe
Resource
win7-20230831-en
4 signatures
150 seconds
General
-
Target
3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe
-
Size
4.4MB
-
MD5
3e80e71617fd695bae1487ca2ee33e6a
-
SHA1
c87738c10aa79b10c29c879e6cb7dba0b7466cbb
-
SHA256
3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f
-
SHA512
87017d9fe1ef34343451e202ce9e602695563d30d5bdcb2e27d6f2f4df700fc0b807432575bacb6d5ec5e05ae906083d116f1b297a8fa4816c24c569a7f17c30
-
SSDEEP
98304:VnywQWw1KWcNoIfNw947J0MFAs49qDjYH/t8R834:Vn2x1GoIb1x+9H/tG
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2236-35-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2236-34-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2236-36-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2236-37-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2236-39-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2236-41-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2236-43-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2236-45-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2236-47-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2236-49-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2236-51-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2236-53-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2236-55-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2236-58-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2236-60-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2236-62-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2236-64-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2236-66-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2236-70-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2236-73-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2236-77-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2236-79-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2236-82-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2236-84-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2236-85-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2236-86-0x0000000010000000-0x000000001003E000-memory.dmp upx -
resource yara_rule behavioral1/memory/2236-3-0x0000000000400000-0x0000000000C4E000-memory.dmp vmprotect behavioral1/memory/2236-31-0x0000000000400000-0x0000000000C4E000-memory.dmp vmprotect behavioral1/memory/2236-56-0x0000000000400000-0x0000000000C4E000-memory.dmp vmprotect -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe 2236 3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe"C:\Users\Admin\AppData\Local\Temp\3079349d7bf2732390b12bb0c33234f525f33eac30113d19458302eb89188e1f.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2236