Analysis
-
max time kernel
122s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
14/10/2023, 12:04
Static task
static1
Behavioral task
behavioral1
Sample
a36c216b80fcbba3e5455c348f4027d08d26547ab7c9c952326698a34b72269d.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
a36c216b80fcbba3e5455c348f4027d08d26547ab7c9c952326698a34b72269d.exe
Resource
win10v2004-20230915-en
General
-
Target
a36c216b80fcbba3e5455c348f4027d08d26547ab7c9c952326698a34b72269d.exe
-
Size
4.1MB
-
MD5
5a196561b0684bfb86d29acbb9b8aad0
-
SHA1
a5d51f8b6d47e2446d717ed64f5f35e8d339b817
-
SHA256
a36c216b80fcbba3e5455c348f4027d08d26547ab7c9c952326698a34b72269d
-
SHA512
4cabe8c28d64a9afbd7cb4068e807182005c648b198ffe5c92f30a4ce6c36826036faca0eb5371c29e3943b58188ed710624d475bcdfe9c9c28bf0662e458b3d
-
SSDEEP
49152:c0etzNKuuadmIrWueVInS4eoZ3hC1mY8ERjGVOSs:qDKuuaviueVIS4JZRpLZ7s
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/880-1-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/880-5-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/880-7-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/880-9-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/880-11-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/880-13-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/880-17-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/880-19-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/880-23-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/880-27-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/880-29-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/880-31-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/880-36-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/880-38-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/880-40-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/880-44-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/880-42-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/880-34-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/880-25-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/880-21-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/880-15-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/880-3-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/880-2-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/880-0-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/880-45-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 880 a36c216b80fcbba3e5455c348f4027d08d26547ab7c9c952326698a34b72269d.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 880 a36c216b80fcbba3e5455c348f4027d08d26547ab7c9c952326698a34b72269d.exe 880 a36c216b80fcbba3e5455c348f4027d08d26547ab7c9c952326698a34b72269d.exe 880 a36c216b80fcbba3e5455c348f4027d08d26547ab7c9c952326698a34b72269d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a36c216b80fcbba3e5455c348f4027d08d26547ab7c9c952326698a34b72269d.exe"C:\Users\Admin\AppData\Local\Temp\a36c216b80fcbba3e5455c348f4027d08d26547ab7c9c952326698a34b72269d.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:880