Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
21/11/2023, 00:06
Static task
static1
Behavioral task
behavioral1
Sample
a9cb0204cbdeee1f6247bb474e7350419db204bf12c29310af4275a2aa50aaaa.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
a9cb0204cbdeee1f6247bb474e7350419db204bf12c29310af4275a2aa50aaaa.exe
Resource
win10v2004-20231020-en
General
-
Target
a9cb0204cbdeee1f6247bb474e7350419db204bf12c29310af4275a2aa50aaaa.exe
-
Size
3.5MB
-
MD5
a94ef593d83b854712fa063bd04ffbf0
-
SHA1
4bd671c7941710bfa6ecd1e68ef0c9fac01f2254
-
SHA256
a9cb0204cbdeee1f6247bb474e7350419db204bf12c29310af4275a2aa50aaaa
-
SHA512
2141efa6e9cff6d806e4f4d99f8da0f6750560f6269dc440871edbc02cfe4623b45eaf51e701ad4c8fd3c0b1fd00a688f51fe880c8e6067dee92fe8f4f2599ce
-
SSDEEP
98304:uLq2JVNarg7w+kHrMmmqRAEIQCWsUW+ISfCpXRg1/oqrH5i7SkzeTR3PS/VW6Q1f:6q2JVNarg7w+kHrLmqRAEIQCWsUW+ISH
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2208-1-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2208-2-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2208-3-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2208-5-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2208-7-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2208-9-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2208-11-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2208-13-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2208-16-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2208-18-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2208-20-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2208-22-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2208-26-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2208-24-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2208-29-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2208-31-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2208-33-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2208-37-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2208-35-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2208-42-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2208-46-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2208-44-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2208-40-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2208-47-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2208 a9cb0204cbdeee1f6247bb474e7350419db204bf12c29310af4275a2aa50aaaa.exe 2208 a9cb0204cbdeee1f6247bb474e7350419db204bf12c29310af4275a2aa50aaaa.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2208 a9cb0204cbdeee1f6247bb474e7350419db204bf12c29310af4275a2aa50aaaa.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2208 a9cb0204cbdeee1f6247bb474e7350419db204bf12c29310af4275a2aa50aaaa.exe 2208 a9cb0204cbdeee1f6247bb474e7350419db204bf12c29310af4275a2aa50aaaa.exe 2208 a9cb0204cbdeee1f6247bb474e7350419db204bf12c29310af4275a2aa50aaaa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9cb0204cbdeee1f6247bb474e7350419db204bf12c29310af4275a2aa50aaaa.exe"C:\Users\Admin\AppData\Local\Temp\a9cb0204cbdeee1f6247bb474e7350419db204bf12c29310af4275a2aa50aaaa.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2208