Analysis
-
max time kernel
142s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
12-10-2023 13:28
General
-
Target
7fd109532f1e49cf074be541df38e0ce190497847fdb5588767ca35b9620a6c2.exe
-
Size
196KB
-
MD5
e5957ccf597223d69d56ff50d810246b
-
SHA1
d41e96dedbe7c04439ba489535eb65d0c7b17674
-
SHA256
7fd109532f1e49cf074be541df38e0ce190497847fdb5588767ca35b9620a6c2
-
SHA512
0025c7dcb8f15fca34644265ef61c46abdec9f3a5403de84660fd9b75d55834d4b0c4ea2e37293ec81ed52da58dab6fcecbc8b19cad91b71b6a00a7c79f5fa00
-
SSDEEP
6144:LqFG9CcmjzJPsvnlHd4sshj8WujTqsHG3:LkG+JMnZCTpym
Malware Config
Signatures
-
Ploutus
Ploutus is an ATM malware written in C#.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7fd109532f1e49cf074be541df38e0ce190497847fdb5588767ca35b9620a6c2.exe"C:\Users\Admin\AppData\Local\Temp\7fd109532f1e49cf074be541df38e0ce190497847fdb5588767ca35b9620a6c2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
299B
MD50aaff1895dd5bc6547cc609933655569
SHA1b17a5680e75b07bad3806fd567e03c02acb26f9e
SHA256a53c2461f19c3be51a7a5841a3fbf545551afa35c001fd46146dddd817a21ee9
SHA512966b4279a396b7f6d6b2a8845e7f5f4239f222720d1c1a60b320ed7466b619147c0ff72d8e3120a27ec570dab76223b6043213f3967c9d1099207026e1c3c161
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
64KB