Analysis
-
max time kernel
142s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
30-12-2023 01:12
General
-
Target
09ae3b0a33f7880ee38c428d596de8ba.exe
-
Size
1.9MB
-
MD5
09ae3b0a33f7880ee38c428d596de8ba
-
SHA1
3cbe809f6a8e734f6f765fe2062a4add2cf79828
-
SHA256
4b136365472bd1358a5dc4090b4c5c57ad219d810af59e36136ee9dc41737d33
-
SHA512
0b1cb9045fcbaa30b7724b1679b3e96b623b82e94da07f301291f9e0da881394847cdd88132642c18b4257bb5d70a6bf0f468a00fb0c43eb12fec701a16dbabd
-
SSDEEP
49152:uedx5C5lzhIxOjI16oDB7G5tkLJJZIDd2yZtIwK:Fx5CLq2aZG4JYltIB
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 6 IoCs
-
Themida packer 18 IoCs
Detects Themida, an advanced Windows software protection system.
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\09ae3b0a33f7880ee38c428d596de8ba.exe"C:\Users\Admin\AppData\Local\Temp\09ae3b0a33f7880ee38c428d596de8ba.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Set_Lime.exeC:\Users\Admin\AppData\Local\Temp\Set_Lime.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\keygen_unpack.exeC:\Users\Admin\AppData\Local\Temp\keygen_unpack.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
480KB
MD52cce3bcce36dcd8ae239ad5ea5f148a8
SHA15fe65595580aca2749ef15963a5bee09114061f5
SHA2568b19661078452d526454d6bde304f7e2a4457826e8a0c97c8f69bd6e1c18f13f
SHA512a0d39bb7a1896eb44f0e8d5500605dc1cab4803ef2b6f4d231614df67308b1b99ca289cc7295ad7390e7c44599ece64857f8ab7bd3d37d735e98763c48625d5c
-
Filesize
254KB
MD53b1935e07d84f5139f6df03058f4eadb
SHA19ec7560352e9596cdad4ec2ccf89de0e92b77942
SHA2562adde026ed14d955795069860b7e3e1ce391be036b9d1e04019fc32e4c4f6a5a
SHA51237ec04e18747f545b87c7913a59cc306181926c901d716535ab6f772104842a9665a895bff306c4b9ec4f8bbf32b54f827dd06c9c911bb3008b4a1557e2d36e7
-
Filesize
256KB
MD53c974f25e43b4e1bd6559229446e3f4a
SHA1475cdc890afe1201c80e6f40df856b8560b8f62b
SHA25682a4a691e8a9a3d6f183992ec1557fd7357a74b62833b26e8b3e68f33ea6d5ec
SHA5129573b0bce6d83678a433435a2fc4a3bd61fe4cbea233c3793325f0ca4c34f64e4a1341036f6e61740488aeba7ac0af5ab46da876e6fb0f0ba1623afe5348141f
-
Filesize
316KB
MD53ab7d4d54edcea1f19fa9f1d7e38fb44
SHA1afed969c1d498cb0d0b93c31a437f278a118d928
SHA2568a64b4ac30f910d99d6eae0931e6bc9469277391849980216fece45bffcb1f88
SHA51289683e92cd1dad8bb82919bce450996d4bb4850e60b3d999285a45ceadf7ccd5b2786d099b6fde77b34768f5a3c534f6c9fd44b08b9228084a7fea8f1789daae
-
Filesize
516KB
-
Filesize
904KB
-
Filesize
4KB
-
Filesize
904KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
904KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
904KB
-
Filesize
4KB
-
Filesize
904KB
-
Filesize
4KB
-
Filesize
904KB
-
Filesize
4KB
-
Filesize
744KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
412KB
-
Filesize
744KB
-
Filesize
744KB