Analysis
-
max time kernel
5s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
07/01/2024, 19:36
Behavioral task
behavioral1
Sample
adec6573d4a87df78f8ea430d653b6f7.exe
Resource
win7-20231215-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
adec6573d4a87df78f8ea430d653b6f7.exe
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
adec6573d4a87df78f8ea430d653b6f7.exe
-
Size
229KB
-
MD5
adec6573d4a87df78f8ea430d653b6f7
-
SHA1
53b473b878de6ca4690724fedb6a7a298ccd1a7d
-
SHA256
75c2eae351fa0ea16b7213637ee0fcbe02f09504893a964906238a264e7f054a
-
SHA512
a434897f4bee4e78d7f238f40201193110ffc13b283c2373b6e562731a4a6c30a72b9a65046c5cdf69d535bf2dfabc12bfb5736a4f4970dab93c71178079da27
-
SSDEEP
3072:VeyMPsEA4KzMWOBImM9uCu9i7kWgIwYYWQRJNjirveLd0maoutj:IsEA4KzMWOBI19uCu9i7kWgZaoS
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2408 winlogon.exe -
Loads dropped DLL 2 IoCs
pid Process 1900 adec6573d4a87df78f8ea430d653b6f7.exe 1900 adec6573d4a87df78f8ea430d653b6f7.exe -
resource yara_rule behavioral1/memory/1900-0-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral1/memory/2408-17-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral1/memory/1900-13-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral1/files/0x000c000000014549-6.dat upx behavioral1/memory/2852-22-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2852-24-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2852-23-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2852-19-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2852-160-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2408-481-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral1/memory/2852-563-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2852-2320-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2852-2321-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2852-2323-0x0000000000400000-0x0000000000428000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1900 adec6573d4a87df78f8ea430d653b6f7.exe 2408 winlogon.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1900 wrote to memory of 2408 1900 adec6573d4a87df78f8ea430d653b6f7.exe 28 PID 1900 wrote to memory of 2408 1900 adec6573d4a87df78f8ea430d653b6f7.exe 28 PID 1900 wrote to memory of 2408 1900 adec6573d4a87df78f8ea430d653b6f7.exe 28 PID 1900 wrote to memory of 2408 1900 adec6573d4a87df78f8ea430d653b6f7.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\adec6573d4a87df78f8ea430d653b6f7.exe"C:\Users\Admin\AppData\Local\Temp\adec6573d4a87df78f8ea430d653b6f7.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\E696D64614\winlogon.exe"C:\Users\Admin\E696D64614\winlogon.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2408 -
C:\Users\Admin\E696D64614\winlogon.exe"C:\Users\Admin\E696D64614\winlogon.exe"3⤵PID:2852
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵PID:2140
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2140 CREDAT:275457 /prefetch:22⤵PID:1732
-