c40fab7a7fecd2b6a9da7b495ee6e27be3404769198dfe54b74d48bf6d105596

Analysis

max time kernel
3s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 03:47

Target

26df53fde514eca2bcaa5bd1e678df7a.exe
Size

132KB
MD5

26df53fde514eca2bcaa5bd1e678df7a
SHA1

0143146d273de666d22db6fc2fd4b89ab054e163
SHA256

c40fab7a7fecd2b6a9da7b495ee6e27be3404769198dfe54b74d48bf6d105596
SHA512

a4b249cd6267b750566dd32c0bbdde783334a37caec3275dd3f6bd6e71be8ae4bd5f3c8bb3f7d7723d80145eb8bf13ed435b9609af8c79b1532840dba47728ec
SSDEEP

3072:+dEgB1HxLbuPpdyg/ZsjnT8wGZyGXLwVQ7KLewZ7vY/v2EBPBtuxjYvA:+dEY1HlbuPSghsjnTzucVQ7SewZk/eo1

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2372	Qronua.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job	26df53fde514eca2bcaa5bd1e678df7a.exe
File opened for modification	C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job	26df53fde514eca2bcaa5bd1e678df7a.exe
File created	C:\Windows\Qronua.exe	26df53fde514eca2bcaa5bd1e678df7a.exe
File opened for modification	C:\Windows\Qronua.exe	26df53fde514eca2bcaa5bd1e678df7a.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1712	26df53fde514eca2bcaa5bd1e678df7a.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2372	1712	26df53fde514eca2bcaa5bd1e678df7a.exe	28
PID 1712 wrote to memory of 2372	1712	26df53fde514eca2bcaa5bd1e678df7a.exe	28
PID 1712 wrote to memory of 2372	1712	26df53fde514eca2bcaa5bd1e678df7a.exe	28
PID 1712 wrote to memory of 2372	1712	26df53fde514eca2bcaa5bd1e678df7a.exe	28

C:\Users\Admin\AppData\Local\Temp\26df53fde514eca2bcaa5bd1e678df7a.exe
"C:\Users\Admin\AppData\Local\Temp\26df53fde514eca2bcaa5bd1e678df7a.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\Qronua.exe
  C:\Windows\Qronua.exe
  2⤵
  - Executes dropped EXE
  PID:2372

memory/1712-1-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1712-0-0x00000000003B0000-0x00000000003C6000-memory.dmp

Filesize
88KB

Download
memory/1712-45808-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1712-45810-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2372-11-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2372-45809-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2372-45811-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2372-45812-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2372-45813-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2372-45815-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2372-45819-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2372-45820-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download