Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 00:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
46241fa1054b7d803c8ce1dd03976990.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
46241fa1054b7d803c8ce1dd03976990.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
46241fa1054b7d803c8ce1dd03976990.exe
-
Size
315KB
-
MD5
46241fa1054b7d803c8ce1dd03976990
-
SHA1
adbca2e37c56354c91fc8c4fc53b23c32bac5a73
-
SHA256
f033a6414a233485e972c1705b6ebf9d79bee14f16af8e729761f1c7af7c3b9f
-
SHA512
30ecc8110ced3220fcdecaeab8469e6d2d97c789225e6c0381d483e427c2b90c01700dea6f11b02529903460025dc9200542237e11ff0061ed38459bba2bb4f8
-
SSDEEP
3072:PjxBvj9C3/KMUt02JHabMlTBvj9CJ/KMOov:rLjuJU0CGGxjeJ5v
Score
10/10
Malware Config
Extracted
Credentials
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
mirtis123
Signatures
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 whatismyip.com -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2932 46241fa1054b7d803c8ce1dd03976990.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2932 46241fa1054b7d803c8ce1dd03976990.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe 2932 46241fa1054b7d803c8ce1dd03976990.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\46241fa1054b7d803c8ce1dd03976990.exe"C:\Users\Admin\AppData\Local\Temp\46241fa1054b7d803c8ce1dd03976990.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2932