Analysis
-
max time kernel
120s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
13/10/2023, 12:51
Behavioral task
behavioral1
Sample
89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe
Resource
win10v2004-20230915-en
General
-
Target
89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe
-
Size
9.4MB
-
MD5
5e3d56bca2a37b5781f75cdf86a3b0cb
-
SHA1
b07c41391ebd8da028cba1be78c78b0f93bcf092
-
SHA256
89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c
-
SHA512
c9a432bbae8da4fad1ce2239145777afef5e60d8c2a2b4ee544c9db661a5fe890d340440064840c90f362dab0cc804cf4df2481a210811117364fff2a2a09297
-
SSDEEP
196608:pS7mQRwHNLJuAdooVj4ImBELJsQdmjsCROjK/sf8wryRvJHOvlWk+Z1O:JZVL4CddvjK/MGvBSlWlO
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2728 89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe -
resource yara_rule behavioral1/memory/3000-5-0x0000000000400000-0x0000000001DFF000-memory.dmp vmprotect behavioral1/memory/3000-42-0x0000000000400000-0x0000000001DFF000-memory.dmp vmprotect behavioral1/memory/3000-43-0x0000000000400000-0x0000000001DFF000-memory.dmp vmprotect behavioral1/memory/2728-49-0x0000000000400000-0x0000000001DFF000-memory.dmp vmprotect behavioral1/memory/2728-87-0x0000000000400000-0x0000000001DFF000-memory.dmp vmprotect behavioral1/memory/2728-88-0x0000000000400000-0x0000000001DFF000-memory.dmp vmprotect -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 3000 89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe 3000 89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe 2728 89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe 2728 89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe 2728 89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe 2728 89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe 2728 89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3000 89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe 3000 89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe 2728 89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe 2728 89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3000 wrote to memory of 2728 3000 89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe 29 PID 3000 wrote to memory of 2728 3000 89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe 29 PID 3000 wrote to memory of 2728 3000 89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe 29 PID 3000 wrote to memory of 2728 3000 89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe"C:\Users\Admin\AppData\Local\Temp\89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exeC:\Users\Admin\AppData\Local\Temp\89ac3e47bab410f8a9d7cf2ac1d992a7676ff555fa208c38b2ab997386569e1c.exe2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2728
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5031ad1ecd93701d39265771942ec716c
SHA1cb3ef507bf0e848894fbb96a29bfc94a0c302152
SHA2569a7fde2ea7883701bf858e0daef74d787a31c3cbd9f1171cec0a3a382ee9e6ba
SHA512374dab32b6304834c7acd8b5e6701ece016bf57d3abdd416ef2b63f7cbda24c9e59f9dfc27b6823ac6256bbab38aace74334dec7d57f1ef6cb9b80c239003bae
-
Filesize
1.6MB
MD5031ad1ecd93701d39265771942ec716c
SHA1cb3ef507bf0e848894fbb96a29bfc94a0c302152
SHA2569a7fde2ea7883701bf858e0daef74d787a31c3cbd9f1171cec0a3a382ee9e6ba
SHA512374dab32b6304834c7acd8b5e6701ece016bf57d3abdd416ef2b63f7cbda24c9e59f9dfc27b6823ac6256bbab38aace74334dec7d57f1ef6cb9b80c239003bae