Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24-12-2023 15:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
03cd61b9945dec53f5b4593bd340e204.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
03cd61b9945dec53f5b4593bd340e204.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
03cd61b9945dec53f5b4593bd340e204.exe
-
Size
264KB
-
MD5
03cd61b9945dec53f5b4593bd340e204
-
SHA1
7d480f73acdfe01743816bbbb5ec83949fef33cd
-
SHA256
f93720bb60fd94e9bfc8a84507167f8004f9d17ea6e7197c2b162a98856dea55
-
SHA512
1baee9e3a04f1b99d1af6934f4f4e52368f2a31fe38e27413b4917aab3cf20cb70a1d2ddfd075cf7a2971f332d3a746437bb804e0bede1f62ea18f5c47d50fdd
-
SSDEEP
6144:WraEs1nsSno6M0dCTSldS6Zx21BYfnULMg63jh:FP1nfnbI+ldHxEYPI
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 10 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\Helicon\server10.ini 03cd61b9945dec53f5b4593bd340e204.exe File opened for modification C:\WINDOWS\SysWOW64\Helicon\server3.ini 03cd61b9945dec53f5b4593bd340e204.exe File opened for modification C:\WINDOWS\SysWOW64\Helicon\server6.ini 03cd61b9945dec53f5b4593bd340e204.exe File opened for modification C:\WINDOWS\SysWOW64\Helicon\server7.ini 03cd61b9945dec53f5b4593bd340e204.exe File opened for modification C:\WINDOWS\SysWOW64\Helicon\server5.ini 03cd61b9945dec53f5b4593bd340e204.exe File opened for modification C:\WINDOWS\SysWOW64\Helicon\server8.ini 03cd61b9945dec53f5b4593bd340e204.exe File opened for modification C:\WINDOWS\SysWOW64\Helicon\server9.ini 03cd61b9945dec53f5b4593bd340e204.exe File opened for modification C:\WINDOWS\SysWOW64\Helicon\server1.ini.ini 03cd61b9945dec53f5b4593bd340e204.exe File opened for modification C:\WINDOWS\SysWOW64\Helicon\server2.ini 03cd61b9945dec53f5b4593bd340e204.exe File opened for modification C:\WINDOWS\SysWOW64\Helicon\server4.ini 03cd61b9945dec53f5b4593bd340e204.exe -
Drops file in Program Files directory 21 IoCs
description ioc Process File opened for modification C:\Program Files\Helicon\SeaPort3.ini 03cd61b9945dec53f5b4593bd340e204.exe File opened for modification C:\Program Files\Helicon\SeaPort9.ini 03cd61b9945dec53f5b4593bd340e204.exe File opened for modification C:\Program Files\CybeRLink\CybeRLink1.ini 03cd61b9945dec53f5b4593bd340e204.exe File opened for modification C:\Program Files\Helicon\SeaPort1.ini 03cd61b9945dec53f5b4593bd340e204.exe File opened for modification C:\Program Files\Helicon\SeaPort2.ini 03cd61b9945dec53f5b4593bd340e204.exe File opened for modification C:\Program Files\Helicon\SeaPort5.ini 03cd61b9945dec53f5b4593bd340e204.exe File opened for modification C:\Program Files\CybeRLink\CybeRLink5.ini 03cd61b9945dec53f5b4593bd340e204.exe File opened for modification C:\Program Files\CybeRLink\CybeRLink6.ini 03cd61b9945dec53f5b4593bd340e204.exe File opened for modification C:\Program Files\CybeRLink\CybeRLink7.ini 03cd61b9945dec53f5b4593bd340e204.exe File opened for modification C:\Program Files\CybeRLink\CybeRLink10.ini 03cd61b9945dec53f5b4593bd340e204.exe File opened for modification C:\Program Files\Helicon\SeaPort4.ini 03cd61b9945dec53f5b4593bd340e204.exe File opened for modification C:\Program Files\Helicon\SeaPort6.ini 03cd61b9945dec53f5b4593bd340e204.exe File opened for modification C:\Program Files\Helicon\SeaPort7.ini 03cd61b9945dec53f5b4593bd340e204.exe File opened for modification C:\Program Files\Helicon\SeaPort8.ini 03cd61b9945dec53f5b4593bd340e204.exe File opened for modification C:\Program Files\Helicon\SeaPort10.ini 03cd61b9945dec53f5b4593bd340e204.exe File opened for modification C:\Program Files\CybeRLink\CybeRLink2.ini 03cd61b9945dec53f5b4593bd340e204.exe File opened for modification C:\Program Files\CybeRLink\CybeRLink3.ini 03cd61b9945dec53f5b4593bd340e204.exe File opened for modification C:\Program Files\CybeRLink\CybeRLink4.ini 03cd61b9945dec53f5b4593bd340e204.exe File opened for modification C:\Program Files\CybeRLink\CybeRLink8.ini 03cd61b9945dec53f5b4593bd340e204.exe File opened for modification C:\Program Files\CybeRLink\CybeRLink9.ini 03cd61b9945dec53f5b4593bd340e204.exe File opened for modification C:\Program Files\NetMeeting\test.log 03cd61b9945dec53f5b4593bd340e204.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2184 03cd61b9945dec53f5b4593bd340e204.exe 2184 03cd61b9945dec53f5b4593bd340e204.exe 2184 03cd61b9945dec53f5b4593bd340e204.exe 2184 03cd61b9945dec53f5b4593bd340e204.exe