20d386aba16e276e082b09075c0c0d1295bff1bf92730dbd991bfaa1296f9a09

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 13:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

20d386aba16e276e082b09075c0c0d1295bff1bf92730dbd991bfaa1296f9a09.exe
Size

4.7MB
MD5

3c3bf0aa3e4ae7d41d9ea3420c7fa690
SHA1

4597ced3f25dde00307f247d2890bb6eeb830f73
SHA256

20d386aba16e276e082b09075c0c0d1295bff1bf92730dbd991bfaa1296f9a09
SHA512

82012b66f8beb8133c9b12007223489893e911a2946f747733cbe46969eea344c3aa21216baf5fa297c9d65dd8f915208df48f5405d386494fbb1098f3444b82
SSDEEP

98304:ZhIHjWibmorLobjYE08GKdzOJDb4v+zlz:GWibmoZmwN0v+R

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
1104	20d386aba16e276e082b09075c0c0d1295bff1bf92730dbd991bfaa1296f9a09.exe
1104	20d386aba16e276e082b09075c0c0d1295bff1bf92730dbd991bfaa1296f9a09.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1104	20d386aba16e276e082b09075c0c0d1295bff1bf92730dbd991bfaa1296f9a09.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1104	20d386aba16e276e082b09075c0c0d1295bff1bf92730dbd991bfaa1296f9a09.exe

C:\Users\Admin\AppData\Local\Temp\20d386aba16e276e082b09075c0c0d1295bff1bf92730dbd991bfaa1296f9a09.exe
"C:\Users\Admin\AppData\Local\Temp\20d386aba16e276e082b09075c0c0d1295bff1bf92730dbd991bfaa1296f9a09.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabCC95.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
5KB

MD5
33ec4b80dec58a0e1dc1858a48b4143e

SHA1
d51d75e50505dbb056e604744a5bf44cdc7ad510

SHA256
a1bf56a27a80cfba3bb10f9ce5e916d10dc9a0c46eca042da32c6859108ee9f8

SHA512
e3bf8eb5db2116a9bbdfd9367f1b8520934d4ab49feb9f7494432a2e707bf17d9b71e3b03900749639c9e665fa141927c282568defd3be155d3101d14f193a8d

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
d1dfe5ea85a870fece975ad1ffeaf7f1

SHA1
110aa769a9d0b05b4fa077114387941937254483

SHA256
24783dbfe247eb903e1e231cb5247023bea9de1f1c5fcf4c9ef5301a41add7db

SHA512
f611b483464346bf40b7bd452127a23b476909a4481f38473a8c0604c68bf8fb515246b95823c6db2ab28b6018063c9329254ba3823281a39b4ad9e6a3d64459

Download Submit
\Users\Admin\AppData\Local\Temp\ybAD11.tmp

Filesize
4.9MB

MD5
5a1f89eb1959df5683d47f6c535c9376

SHA1
0e86d6b70a28d6f01043e117cf91131a26b0da7b

SHA256
ec6aa06757579ecdb38b149aac681308b8a3f71c3bf97bd96d7209c075f3f4c8

SHA512
3df1fb89fbc8a6b5b463d0b8ab256ff10d2897e0bd3bcedca755369f00fad315978fe60ffff817f12c498bd7a51e23d285e552be1cb942aa1bc2b9da5357dca0

Download Submit
\Users\Admin\AppData\Local\Temp\ybAD11.tmp

Filesize
8.4MB

MD5
81951aa4edba474d6efdea00b6316a86

SHA1
5b4bae7761bbbdcc20ade7bd679a3d2e44a0e6ec

SHA256
6a5a7ce8103ca63b91dbe12ef374f68458a5591966185903b38574c9386c7db8

SHA512
b46f8b1faac45616086686ed77544d19415da034ce3f60e8cb7ed996a7e74a61f724ab8462b402cd449fdcc5244fa35c722988b742018b06a2cb434325b8707b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads