Analysis
-
max time kernel
165s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
13-10-2023 13:01
Static task
static1
Behavioral task
behavioral1
Sample
9557eff5436e00b79caac8938c5338b9d3a9f9edb458535828915c25a2c7834b.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
9557eff5436e00b79caac8938c5338b9d3a9f9edb458535828915c25a2c7834b.exe
Resource
win10v2004-20230915-en
General
-
Target
9557eff5436e00b79caac8938c5338b9d3a9f9edb458535828915c25a2c7834b.exe
-
Size
13.6MB
-
MD5
6467c368d96a8e8fa72ad4b02e0217a0
-
SHA1
f5db9695becd9aad863084b9cecfe9888f48f55b
-
SHA256
9557eff5436e00b79caac8938c5338b9d3a9f9edb458535828915c25a2c7834b
-
SHA512
67541d0a65654ad536bb96d43b81659eb2a5b5c0a7cc3bf622655c1c9c801d32880df8089c0971261c1e06178e73de1c50fe760806708f5f7cfb47f874db9d83
-
SSDEEP
393216:jpDfJ7BmeImJqiEnWvjtrkQN9a8ItYeMoByf:1DOeNJqiqWtkR8I8oUf
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
9557eff5436e00b79caac8938c5338b9d3a9f9edb458535828915c25a2c7834b.exepid process 4992 9557eff5436e00b79caac8938c5338b9d3a9f9edb458535828915c25a2c7834b.exe 4992 9557eff5436e00b79caac8938c5338b9d3a9f9edb458535828915c25a2c7834b.exe 4992 9557eff5436e00b79caac8938c5338b9d3a9f9edb458535828915c25a2c7834b.exe 4992 9557eff5436e00b79caac8938c5338b9d3a9f9edb458535828915c25a2c7834b.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
9557eff5436e00b79caac8938c5338b9d3a9f9edb458535828915c25a2c7834b.exedescription pid process target process PID 4992 wrote to memory of 804 4992 9557eff5436e00b79caac8938c5338b9d3a9f9edb458535828915c25a2c7834b.exe cmd.exe PID 4992 wrote to memory of 804 4992 9557eff5436e00b79caac8938c5338b9d3a9f9edb458535828915c25a2c7834b.exe cmd.exe PID 4992 wrote to memory of 804 4992 9557eff5436e00b79caac8938c5338b9d3a9f9edb458535828915c25a2c7834b.exe cmd.exe PID 4992 wrote to memory of 2888 4992 9557eff5436e00b79caac8938c5338b9d3a9f9edb458535828915c25a2c7834b.exe cmd.exe PID 4992 wrote to memory of 2888 4992 9557eff5436e00b79caac8938c5338b9d3a9f9edb458535828915c25a2c7834b.exe cmd.exe PID 4992 wrote to memory of 2888 4992 9557eff5436e00b79caac8938c5338b9d3a9f9edb458535828915c25a2c7834b.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9557eff5436e00b79caac8938c5338b9d3a9f9edb458535828915c25a2c7834b.exe"C:\Users\Admin\AppData\Local\Temp\9557eff5436e00b79caac8938c5338b9d3a9f9edb458535828915c25a2c7834b.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\*7eff5436e00b79caac8938c5338b9d3a9f9edb458535828915c25a2c7834b.exe"2⤵PID:804
-
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\*.dll"2⤵PID:2888
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\9557eff5436e00b79caac8938c5338b9d3a9f9edb458535828915c25a2c7834b.exepack.tmpFilesize
2KB
MD5adbf27d40dfc1004edc3d709d61232d4
SHA1c1e32503ce648bab7271c3e2bae24a50c59680fa
SHA256cd64a4292c7c58ad7078674e8f63ee377f4d94152f35bc226b5c9c62b2fdaf27
SHA512b4c8af868a8227bf3716e8afafee1f921c4c3d48cb59bb2305ab9cc8c273d17061f255a813f5c61a6a5d545df8d0b1568ccde013b0e8a6ab0a94cbe8d55ef6a3
-
C:\Users\Admin\AppData\Local\Temp\b58dacc910f559b63203418c907523b7.iniFilesize
1KB
MD50e3bf91d2f24fdc90f94a1322eedcf6e
SHA1543e7965fdd3956615251ab1506f507f03f1ca15
SHA2564ad716cf95c3ed39525e7f53046b688e4f566faafc0ea95c0f638e60b14c1370
SHA5120be375407fe8b7169135043a45347970d6f15a583545c681ca7d02aac9bcd93027f3911d87326208bf34b963f0898558e7aed19ba93556ddb39d9775df282b51
-
C:\Users\Admin\AppData\Local\Temp\b58dacc910f559b63203418c907523b7A.iniFilesize
1KB
MD5446d57052a1b08779cc452c4cf8a1d75
SHA158d778e3bad9bf0ed57c88172ae8b6c58c6b4fe4
SHA256042d1900f531d293a518b8e223f1244d5f032b3b12fad61ffef21aa8ed592dab
SHA512f89f34e08caf355039cc7c3b38c870216af672bdccd242f5be3f0013a58fd355579ed3e7477e50e8de0d5c3d6447a1b9adee9aa5954fc387138cc1e8ad9454a3
-
memory/4992-331-0x0000000000400000-0x0000000001F00000-memory.dmpFilesize
27.0MB
-
memory/4992-333-0x0000000000400000-0x0000000001F00000-memory.dmpFilesize
27.0MB
-
memory/4992-7-0x00000000020E0000-0x00000000020E3000-memory.dmpFilesize
12KB
-
memory/4992-8-0x0000000000400000-0x0000000001F00000-memory.dmpFilesize
27.0MB
-
memory/4992-5-0x0000000050000000-0x0000000050109000-memory.dmpFilesize
1.0MB
-
memory/4992-2-0x0000000000400000-0x0000000001F00000-memory.dmpFilesize
27.0MB
-
memory/4992-1-0x00000000020E0000-0x00000000020E3000-memory.dmpFilesize
12KB
-
memory/4992-0-0x0000000000400000-0x0000000001F00000-memory.dmpFilesize
27.0MB
-
memory/4992-332-0x0000000000400000-0x0000000001F00000-memory.dmpFilesize
27.0MB
-
memory/4992-6-0x0000000000400000-0x0000000001F00000-memory.dmpFilesize
27.0MB
-
memory/4992-334-0x0000000000400000-0x0000000001F00000-memory.dmpFilesize
27.0MB
-
memory/4992-335-0x0000000000400000-0x0000000001F00000-memory.dmpFilesize
27.0MB
-
memory/4992-336-0x0000000000400000-0x0000000001F00000-memory.dmpFilesize
27.0MB
-
memory/4992-337-0x0000000000400000-0x0000000001F00000-memory.dmpFilesize
27.0MB
-
memory/4992-338-0x0000000000400000-0x0000000001F00000-memory.dmpFilesize
27.0MB
-
memory/4992-339-0x0000000000400000-0x0000000001F00000-memory.dmpFilesize
27.0MB
-
memory/4992-340-0x0000000000400000-0x0000000001F00000-memory.dmpFilesize
27.0MB
-
memory/4992-341-0x0000000000400000-0x0000000001F00000-memory.dmpFilesize
27.0MB
-
memory/4992-342-0x0000000000400000-0x0000000001F00000-memory.dmpFilesize
27.0MB
-
memory/4992-343-0x0000000000400000-0x0000000001F00000-memory.dmpFilesize
27.0MB