Analysis

  • max time kernel
    146s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    04-01-2024 09:25

General

  • Target

    SecuriteInfo.com.Trojan-Spy.Win32.Banker.4697.exe

  • Size

    1.2MB

  • MD5

    02e02e7a91db85a2d61188b14612dfc5

  • SHA1

    7c2e84dc445809f15f17c65065b202ef4cf401a9

  • SHA256

    2cab1566a89734389b4cdf0e311d947a7c64c62bd9557cd72f5921fc721432e4

  • SHA512

    d9577033dd575621e3822957e6042ade63803202cdbd747c09cc14f0df37257a31253925559e25b44a74a03b2b6c0a58312dbd50984bfdff08b498ebbbab16be

  • SSDEEP

    12288:o1YC7DflUGEGrj4RKpbAQuGp4G8R+hb6lf6Y05Qw5ZkXikOUAvIalW7XcV8Wx0Ck:U97NEGrj4QuqE+hU6ddHX/Q75W0A2t

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan-Spy.Win32.Banker.4697.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan-Spy.Win32.Banker.4697.exe"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\script.csm

    Filesize

    2B

    MD5

    81051bcc2cf1bedf378224b0a93e2877

    SHA1

    ba8ab5a0280b953aa97435ff8946cbcbb2755a27

    SHA256

    7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

    SHA512

    1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

  • memory/1044-17-0x0000000000400000-0x0000000000543000-memory.dmp

    Filesize

    1.3MB

  • memory/1044-10-0x0000000000400000-0x0000000000543000-memory.dmp

    Filesize

    1.3MB

  • memory/1044-19-0x0000000000400000-0x0000000000543000-memory.dmp

    Filesize

    1.3MB

  • memory/1044-11-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/1044-21-0x0000000000400000-0x0000000000543000-memory.dmp

    Filesize

    1.3MB

  • memory/1044-13-0x0000000000400000-0x0000000000543000-memory.dmp

    Filesize

    1.3MB

  • memory/1044-15-0x0000000000400000-0x0000000000543000-memory.dmp

    Filesize

    1.3MB

  • memory/1044-23-0x0000000000400000-0x0000000000543000-memory.dmp

    Filesize

    1.3MB

  • memory/1044-8-0x0000000000400000-0x0000000000543000-memory.dmp

    Filesize

    1.3MB

  • memory/1044-5-0x00000000037E0000-0x00000000037E1000-memory.dmp

    Filesize

    4KB

  • memory/1044-0-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/1044-25-0x0000000000400000-0x0000000000543000-memory.dmp

    Filesize

    1.3MB

  • memory/1044-27-0x0000000000400000-0x0000000000543000-memory.dmp

    Filesize

    1.3MB

  • memory/1044-29-0x0000000000400000-0x0000000000543000-memory.dmp

    Filesize

    1.3MB

  • memory/1044-31-0x0000000000400000-0x0000000000543000-memory.dmp

    Filesize

    1.3MB

  • memory/1044-33-0x0000000000400000-0x0000000000543000-memory.dmp

    Filesize

    1.3MB

  • memory/1044-35-0x0000000000400000-0x0000000000543000-memory.dmp

    Filesize

    1.3MB