Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
23-10-2023 23:36
Behavioral task
behavioral1
Sample
7c6e03e102ca0e21520f687da5262fca34b0a5a0a295d9a2e7e9e58e32892d44.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
7c6e03e102ca0e21520f687da5262fca34b0a5a0a295d9a2e7e9e58e32892d44.exe
Resource
win10v2004-20231020-en
General
-
Target
7c6e03e102ca0e21520f687da5262fca34b0a5a0a295d9a2e7e9e58e32892d44.exe
-
Size
5.1MB
-
MD5
3445f2023fad401f36ab6511b1c78402
-
SHA1
7fc76e6526c3d2c082540a6695949249fd6fb962
-
SHA256
7c6e03e102ca0e21520f687da5262fca34b0a5a0a295d9a2e7e9e58e32892d44
-
SHA512
cf3f49fd5a109d19a450625c1f1f4b59a8ce04183fcc23c62fd042d63e1b1ec0993e0f295f476bb5b95f46348cd3dfd74288c624ac9bb8fec2eed4f646019d3d
-
SSDEEP
98304:yKPCHgDN8mH0Pad2OWEJ0oAlVGwMgJAMJxZvuwI/vxiUVAlc4JBFn:yKTDN8miOeoAlz/FC/vsUKlc4
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2192 7c6e03e102ca0e21520f687da5262fca34b0a5a0a295d9a2e7e9e58e32892d44.exe -
resource yara_rule behavioral1/memory/2192-0-0x0000000000400000-0x0000000000F3E000-memory.dmp vmprotect behavioral1/memory/2192-4-0x0000000000400000-0x0000000000F3E000-memory.dmp vmprotect behavioral1/memory/2192-22-0x0000000000400000-0x0000000000F3E000-memory.dmp vmprotect behavioral1/memory/2192-23-0x0000000000400000-0x0000000000F3E000-memory.dmp vmprotect -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2192 7c6e03e102ca0e21520f687da5262fca34b0a5a0a295d9a2e7e9e58e32892d44.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2192 7c6e03e102ca0e21520f687da5262fca34b0a5a0a295d9a2e7e9e58e32892d44.exe 2192 7c6e03e102ca0e21520f687da5262fca34b0a5a0a295d9a2e7e9e58e32892d44.exe 2192 7c6e03e102ca0e21520f687da5262fca34b0a5a0a295d9a2e7e9e58e32892d44.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c6e03e102ca0e21520f687da5262fca34b0a5a0a295d9a2e7e9e58e32892d44.exe"C:\Users\Admin\AppData\Local\Temp\7c6e03e102ca0e21520f687da5262fca34b0a5a0a295d9a2e7e9e58e32892d44.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2192
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD5298f5812023bab65ee23d13ee9489a6e
SHA171e9d7f205e5e7af6907c539c77a3aeea971692f
SHA256fe100d35b034c15ae3b74379f4eedd321c8e4b84fe666b54ee924ca2a8bdca6e
SHA512217258fb7728f61199f913fb98c894077c12a124e1596d1c6c7cfc065d4d2a6e1e03ad950c3321e2a8dcd997fb5c9524f98530db4bcb39f9914ecb5ff0e22dbd