Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
10-01-2024 14:37
Static task
static1
Behavioral task
behavioral1
Sample
50d410f895726fea2c56136ecd653512.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
50d410f895726fea2c56136ecd653512.exe
Resource
win10v2004-20231215-en
General
-
Target
50d410f895726fea2c56136ecd653512.exe
-
Size
380KB
-
MD5
50d410f895726fea2c56136ecd653512
-
SHA1
2ef3d4c19fb1644b4bbd0edb2c04c52d97a4af2f
-
SHA256
8f56783370760f9cf4ae78f55c9192b9ae86e67cd03273178fd94cd3def6b71c
-
SHA512
eab396962e800d1b47f87f4865b118598cd73be527394b2c3fbb39a2abb0ffa3c10cf7c1d5bf4f14111a945448fe6b06f9e338142b6d91f0b1cbb862735cdc0c
-
SSDEEP
6144:4MZeQVXPwgDV+AyJQT5rwh/nidGFrdvG5MqhyBFux/RJNR6OSUtR4XYc/f:4MZeQtwgQHQdr6iarJkMGwF8/XP6IR4X
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 5016 integrate.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\boxes\integrate.exe 50d410f895726fea2c56136ecd653512.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 3172 50d410f895726fea2c56136ecd653512.exe 3172 50d410f895726fea2c56136ecd653512.exe 3172 50d410f895726fea2c56136ecd653512.exe 3172 50d410f895726fea2c56136ecd653512.exe 5016 integrate.exe 5016 integrate.exe 5016 integrate.exe 5016 integrate.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3172 wrote to memory of 5016 3172 50d410f895726fea2c56136ecd653512.exe 90 PID 3172 wrote to memory of 5016 3172 50d410f895726fea2c56136ecd653512.exe 90 PID 3172 wrote to memory of 5016 3172 50d410f895726fea2c56136ecd653512.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\50d410f895726fea2c56136ecd653512.exe"C:\Users\Admin\AppData\Local\Temp\50d410f895726fea2c56136ecd653512.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Program Files\boxes\integrate.exe"C:\Program Files\boxes\integrate.exe" "33201"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5016
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
299KB
MD5e013005dce5533f2c2281b55f0da1eba
SHA102f3fd5217acf96faa752d3f5c931573bc5302a7
SHA2568c48fbde3d4ef6cfc9eac39459a01133a7f2a9e0f321518adddccd40526b69bb
SHA512e374b549dd391f401961147d384ff1b88f7831920a623a89e02c504268c98eab31ae80e13f8a6981c76332e1bd12986b2629d784fb3ce7e3329bb2e1e0efeea3
-
Filesize
229KB
MD5e68d3430490758f2a9169f0539a1833c
SHA124c46940c0abfbc9d48ced21f86434efc61d792b
SHA256c30fa4a797f0ea78bce3e1eabd081bc9f7a1e89cb292baa6f96569258a1dfd4d
SHA5126f65045c13a5fab8a39205e87962066a11e2b6185fc39c8a02f4901412e0626524f6c6563507ca885dd8b84b462805728229ebc689c83a8743298857699bf7ad