ea14f22312cd94f9012bf01abb7c4bb3a1c64aa6a1336d0221c9970832b7812b

Analysis

max time kernel
143s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 00:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2115b10faaa0755e1966a79595b6eb32.exe
Size

5.5MB
MD5

2115b10faaa0755e1966a79595b6eb32
SHA1

f5bb267c73b34f0fd88c8b92e7b17e3796741691
SHA256

ea14f22312cd94f9012bf01abb7c4bb3a1c64aa6a1336d0221c9970832b7812b
SHA512

fdb0e2b5296591efc89a24d39483b7834cb4b320a529875b2b42b3632fe0d8d5bc293987d9b06f2033b0e7b5f3bcdbf2504f8d37bce671ec8950811634753d95
SSDEEP

98304:7JrDVFLQ1gEFVk7oeI+SQ7frgou+D8I1Ii+1IW1hOWQoJMg8dkiYFog:7J95QiE3kY+h78Gt14DXfNWk

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs

pid	Process
536	2115b10faaa0755e1966a79595b6eb32.exe
536	2115b10faaa0755e1966a79595b6eb32.exe
536	2115b10faaa0755e1966a79595b6eb32.exe
536	2115b10faaa0755e1966a79595b6eb32.exe
536	2115b10faaa0755e1966a79595b6eb32.exe
536	2115b10faaa0755e1966a79595b6eb32.exe
536	2115b10faaa0755e1966a79595b6eb32.exe
536	2115b10faaa0755e1966a79595b6eb32.exe
536	2115b10faaa0755e1966a79595b6eb32.exe
536	2115b10faaa0755e1966a79595b6eb32.exe
536	2115b10faaa0755e1966a79595b6eb32.exe
536	2115b10faaa0755e1966a79595b6eb32.exe
536	2115b10faaa0755e1966a79595b6eb32.exe
536	2115b10faaa0755e1966a79595b6eb32.exe
536	2115b10faaa0755e1966a79595b6eb32.exe
536	2115b10faaa0755e1966a79595b6eb32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
536	2115b10faaa0755e1966a79595b6eb32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
536	2115b10faaa0755e1966a79595b6eb32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 2720	536	2115b10faaa0755e1966a79595b6eb32.exe	30
PID 536 wrote to memory of 2720	536	2115b10faaa0755e1966a79595b6eb32.exe	30
PID 536 wrote to memory of 2720	536	2115b10faaa0755e1966a79595b6eb32.exe	30
PID 536 wrote to memory of 2720	536	2115b10faaa0755e1966a79595b6eb32.exe	30

C:\Users\Admin\AppData\Local\Temp\2115b10faaa0755e1966a79595b6eb32.exe
"C:\Users\Admin\AppData\Local\Temp\2115b10faaa0755e1966a79595b6eb32.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/536-0-0x0000000000A00000-0x00000000024AC000-memory.dmp

Filesize
26.7MB

Download
memory/536-1-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/536-2-0x0000000077D10000-0x0000000077D11000-memory.dmp

Filesize
4KB

Download
memory/536-3-0x0000000000A00000-0x00000000024AC000-memory.dmp

Filesize
26.7MB

Download
memory/536-4-0x0000000000A00000-0x00000000024AC000-memory.dmp

Filesize
26.7MB

Download
memory/536-5-0x0000000000A00000-0x00000000024AC000-memory.dmp

Filesize
26.7MB

Download
memory/536-6-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/536-7-0x0000000000A00000-0x00000000024AC000-memory.dmp

Filesize
26.7MB

Download
memory/536-8-0x0000000000A00000-0x00000000024AC000-memory.dmp

Filesize
26.7MB

Download
memory/536-9-0x0000000000A00000-0x00000000024AC000-memory.dmp

Filesize
26.7MB

Download
memory/536-10-0x0000000000A00000-0x00000000024AC000-memory.dmp

Filesize
26.7MB

Download
memory/536-11-0x0000000000A00000-0x00000000024AC000-memory.dmp

Filesize
26.7MB

Download
memory/536-12-0x0000000000A00000-0x00000000024AC000-memory.dmp

Filesize
26.7MB

Download
memory/536-13-0x0000000000A00000-0x00000000024AC000-memory.dmp

Filesize
26.7MB

Download
memory/536-14-0x0000000000A00000-0x00000000024AC000-memory.dmp

Filesize
26.7MB

Download
memory/536-15-0x0000000000A00000-0x00000000024AC000-memory.dmp

Filesize
26.7MB

Download
memory/536-16-0x0000000000A00000-0x00000000024AC000-memory.dmp

Filesize
26.7MB

Download
memory/536-17-0x0000000000A00000-0x00000000024AC000-memory.dmp

Filesize
26.7MB

Download
memory/536-18-0x0000000000A00000-0x00000000024AC000-memory.dmp

Filesize
26.7MB

Download