Analysis
-
max time kernel
3s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31-12-2023 01:32
Static task
static1
Behavioral task
behavioral1
Sample
7b684defedd081a8f23bae1441a9c28120b45789e4f56e1abc72619de567aed4.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7b684defedd081a8f23bae1441a9c28120b45789e4f56e1abc72619de567aed4.exe
Resource
win10v2004-20231215-en
General
-
Target
7b684defedd081a8f23bae1441a9c28120b45789e4f56e1abc72619de567aed4.exe
-
Size
18.5MB
-
MD5
833a429520658c6def49887c4de02211
-
SHA1
c913be019fc858aedcbe1d5961a86c783f47c7d8
-
SHA256
7b684defedd081a8f23bae1441a9c28120b45789e4f56e1abc72619de567aed4
-
SHA512
2fe122cb2c129173e7752ec2a3ac61cd5ee8a5251ab4e5a42adb8f80756ebeb3f61464ffd5a13474feeaa971423489dce2cdafd4c7488442c9469d49b3107d0a
-
SSDEEP
393216:aueds7wTccDNVb998gWskbJtYAkCk+uXGmeOWjqV1iqn4Nl:8ZDNVbJfqtYaiGdOWr/
Malware Config
Signatures
-
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\stinger\OpenSans-Regular-webfont.ttf 7b684defedd081a8f23bae1441a9c28120b45789e4f56e1abc72619de567aed4.exe File created C:\Program Files (x86)\stinger\OpenSans-Light-webfont.ttf 7b684defedd081a8f23bae1441a9c28120b45789e4f56e1abc72619de567aed4.exe File created C:\Program Files (x86)\stinger\lockdown.dll 7b684defedd081a8f23bae1441a9c28120b45789e4f56e1abc72619de567aed4.exe -
Loads dropped DLL 1 IoCs
pid Process 2468 7b684defedd081a8f23bae1441a9c28120b45789e4f56e1abc72619de567aed4.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2468 7b684defedd081a8f23bae1441a9c28120b45789e4f56e1abc72619de567aed4.exe 2468 7b684defedd081a8f23bae1441a9c28120b45789e4f56e1abc72619de567aed4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b684defedd081a8f23bae1441a9c28120b45789e4f56e1abc72619de567aed4.exe"C:\Users\Admin\AppData\Local\Temp\7b684defedd081a8f23bae1441a9c28120b45789e4f56e1abc72619de567aed4.exe"1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2468