Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
26/11/2023, 14:18
Static task
static1
Behavioral task
behavioral1
Sample
c49816914f234b65860529744a6db7d5b0033cecfb3ed2dfa51b79c55092039c.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
c49816914f234b65860529744a6db7d5b0033cecfb3ed2dfa51b79c55092039c.exe
Resource
win10v2004-20231023-en
General
-
Target
c49816914f234b65860529744a6db7d5b0033cecfb3ed2dfa51b79c55092039c.exe
-
Size
3.0MB
-
MD5
26df4f482008f44c265b4adccde06ae4
-
SHA1
f7ec3c8475a0bf075d2d7483af37d72c692d18d8
-
SHA256
c49816914f234b65860529744a6db7d5b0033cecfb3ed2dfa51b79c55092039c
-
SHA512
2d0fea76ef0268c15e1596f0f265ce4b11d4cce205898ec271ce1ce86860ebede02dd46a180e42412dc961c6bec41562d3949a05d391c4242b87f3bb05ec4356
-
SSDEEP
49152:kDs+A/TOSE+TFUglrx/qyCIfyS0+s8KuqGaX0ToIBAUZLYlBKjr32iu:NvVxUgldCOB3JBAUZLxjr32x
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2508-0-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2508-2-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2508-1-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2508-3-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2508-5-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2508-8-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2508-10-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2508-12-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2508-15-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2508-17-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2508-20-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2508-22-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2508-25-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2508-27-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2508-30-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2508-32-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2508-34-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2508-37-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2508-39-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2508-42-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2508-44-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2508-47-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2508-49-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2508-52-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2508-53-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2508 c49816914f234b65860529744a6db7d5b0033cecfb3ed2dfa51b79c55092039c.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2508 c49816914f234b65860529744a6db7d5b0033cecfb3ed2dfa51b79c55092039c.exe 2508 c49816914f234b65860529744a6db7d5b0033cecfb3ed2dfa51b79c55092039c.exe 2508 c49816914f234b65860529744a6db7d5b0033cecfb3ed2dfa51b79c55092039c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c49816914f234b65860529744a6db7d5b0033cecfb3ed2dfa51b79c55092039c.exe"C:\Users\Admin\AppData\Local\Temp\c49816914f234b65860529744a6db7d5b0033cecfb3ed2dfa51b79c55092039c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2508