Analysis
-
max time kernel
154s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2023, 02:45
Static task
static1
Behavioral task
behavioral1
Sample
a7d5cac47ef6cd991e9ce2946764ef4fc38c7fc248b551f30ce1894d860b6213.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
a7d5cac47ef6cd991e9ce2946764ef4fc38c7fc248b551f30ce1894d860b6213.exe
Resource
win10v2004-20230915-en
General
-
Target
a7d5cac47ef6cd991e9ce2946764ef4fc38c7fc248b551f30ce1894d860b6213.exe
-
Size
6.1MB
-
MD5
0f609a22a722c6225142ac3c2f8be2ee
-
SHA1
bec5e0692659521218802a5dbc5065d97afe86f9
-
SHA256
a7d5cac47ef6cd991e9ce2946764ef4fc38c7fc248b551f30ce1894d860b6213
-
SHA512
c6af8a95fc8f40e88a63e85fda0b448088f137b074ac8bcc2def749f94f2a7af2e930b78e1df8014ca944172700e3d5108ac936d46465a017adfb7eef44acf33
-
SSDEEP
98304:Q6NHp5LZf8qmq9BEuuz9bPGsLzXN15dKEbLYLAeOdZRNB7IacnQ/5Z0N9QFinZdk:QELdv9YfyQlK059m+/
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1532-0-0x0000000002980000-0x00000000029BE000-memory.dmp upx behavioral2/memory/1532-1-0x0000000002980000-0x00000000029BE000-memory.dmp upx behavioral2/memory/1532-2-0x0000000002980000-0x00000000029BE000-memory.dmp upx behavioral2/memory/1532-3-0x0000000002980000-0x00000000029BE000-memory.dmp upx behavioral2/memory/1532-5-0x0000000002980000-0x00000000029BE000-memory.dmp upx behavioral2/memory/1532-7-0x0000000002980000-0x00000000029BE000-memory.dmp upx behavioral2/memory/1532-9-0x0000000002980000-0x00000000029BE000-memory.dmp upx behavioral2/memory/1532-11-0x0000000002980000-0x00000000029BE000-memory.dmp upx behavioral2/memory/1532-13-0x0000000002980000-0x00000000029BE000-memory.dmp upx behavioral2/memory/1532-15-0x0000000002980000-0x00000000029BE000-memory.dmp upx behavioral2/memory/1532-17-0x0000000002980000-0x00000000029BE000-memory.dmp upx behavioral2/memory/1532-19-0x0000000002980000-0x00000000029BE000-memory.dmp upx behavioral2/memory/1532-21-0x0000000002980000-0x00000000029BE000-memory.dmp upx behavioral2/memory/1532-23-0x0000000002980000-0x00000000029BE000-memory.dmp upx behavioral2/memory/1532-25-0x0000000002980000-0x00000000029BE000-memory.dmp upx behavioral2/memory/1532-27-0x0000000002980000-0x00000000029BE000-memory.dmp upx behavioral2/memory/1532-31-0x0000000002980000-0x00000000029BE000-memory.dmp upx behavioral2/memory/1532-29-0x0000000002980000-0x00000000029BE000-memory.dmp upx behavioral2/memory/1532-33-0x0000000002980000-0x00000000029BE000-memory.dmp upx behavioral2/memory/1532-35-0x0000000002980000-0x00000000029BE000-memory.dmp upx behavioral2/memory/1532-37-0x0000000002980000-0x00000000029BE000-memory.dmp upx behavioral2/memory/1532-39-0x0000000002980000-0x00000000029BE000-memory.dmp upx behavioral2/memory/1532-41-0x0000000002980000-0x00000000029BE000-memory.dmp upx behavioral2/memory/1532-43-0x0000000002980000-0x00000000029BE000-memory.dmp upx behavioral2/memory/1532-44-0x0000000002980000-0x00000000029BE000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1532 a7d5cac47ef6cd991e9ce2946764ef4fc38c7fc248b551f30ce1894d860b6213.exe 1532 a7d5cac47ef6cd991e9ce2946764ef4fc38c7fc248b551f30ce1894d860b6213.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1532 a7d5cac47ef6cd991e9ce2946764ef4fc38c7fc248b551f30ce1894d860b6213.exe 1532 a7d5cac47ef6cd991e9ce2946764ef4fc38c7fc248b551f30ce1894d860b6213.exe 1532 a7d5cac47ef6cd991e9ce2946764ef4fc38c7fc248b551f30ce1894d860b6213.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7d5cac47ef6cd991e9ce2946764ef4fc38c7fc248b551f30ce1894d860b6213.exe"C:\Users\Admin\AppData\Local\Temp\a7d5cac47ef6cd991e9ce2946764ef4fc38c7fc248b551f30ce1894d860b6213.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1532
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54B
MD5db5c1eb2c9ad3ead473c725aa5bd900b
SHA1006a0ef8f902f45f50638055c6872793ff2c21a4
SHA256fd052660a2da7cc85fe056dbd8dd9a211eec06e2b480dbab75e12ed3dfa48b31
SHA51242b53be4364b376dfbc68db361e79e773c1f5168a589423934145384e64674a8677df68379104ac839ec5ba34a9684c52822b16d4fa0703abd7ffe5618c39f03