000752074544950ae9020a35ccd77de277f1cd5026b4b9559279dc3b86965eee | Triage

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
15-12-2023 01:47

Sharing

Report Analysis Logs

General

Target

HWMonitor.exe
Size

6.4MB
MD5

19a05a559b0c478f3049cd414300a340
SHA1

fadbbb63e948b5b3bbbaeedc77e69472143a3b86
SHA256

000752074544950ae9020a35ccd77de277f1cd5026b4b9559279dc3b86965eee
SHA512

1f9b320048958fb5b81b8dc6f8ab402d795175dda3476f7cc7251642383345538320eaa4d24de7d0f7e2d2d59073cbc9a250226ee06bc0f0dfab8bb5673aaa84
SSDEEP

49152:GkzIAFeiibxQU6vdYqTzEuZf6Q9iBUqL5cQf3S9+uCQHSvT9A+aoNDqcKqQx759B:Nnu7S/QN+on

Score

6^/10

Malware Config

Signatures

GLES Rule: track HazyLoad proxy tool in memory. 1 IoCs

detect proxy-related strings loaded in memory by HazyLoad loader.

Processes:

resource	yara_rule
behavioral1/memory/2576-0-0x00000000000E0000-0x0000000000107000-memory.dmp	APT_NK_TA430_HazyLoad_Mem

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

HWMonitor.exe

pid process

2576 HWMonitor.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

HWMonitor.exe

pid process

2576 HWMonitor.exe

C:\Users\Admin\AppData\Local\Temp\HWMonitor.exe
"C:\Users\Admin\AppData\Local\Temp\HWMonitor.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2576

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2576-0-0x00000000000E0000-0x0000000000107000-memory.dmp

Filesize
156KB

Download