Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
13/01/2024, 07:13
Static task
static1
Behavioral task
behavioral1
Sample
584e1bc286eb8955da6903f90bffe669.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
584e1bc286eb8955da6903f90bffe669.exe
Resource
win10v2004-20231215-en
General
-
Target
584e1bc286eb8955da6903f90bffe669.exe
-
Size
804KB
-
MD5
584e1bc286eb8955da6903f90bffe669
-
SHA1
6cfd818d147a78d5a43e9e06070cfb74f6748745
-
SHA256
c142d9820ded00be039a926a070dbbc1d8a748313a3fac67ad379600e67a1449
-
SHA512
d1e5cbf8d2b412059bcfbd5cce9b312575bd3ad8f4c14c9884092a41222a13b7a15807be85ed6e638acced9f9c0fbc43599f16fab491b48aaed2c7315570253b
-
SSDEEP
24576:YOWsrPXzaGZteD0Mi+iuasv1tl3HwUpmZ:YFmPpU0Mi+l93QQmZ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1980 system.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4208 584e1bc286eb8955da6903f90bffe669.exe 4208 584e1bc286eb8955da6903f90bffe669.exe 4208 584e1bc286eb8955da6903f90bffe669.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4208 wrote to memory of 1980 4208 584e1bc286eb8955da6903f90bffe669.exe 91 PID 4208 wrote to memory of 1980 4208 584e1bc286eb8955da6903f90bffe669.exe 91 PID 4208 wrote to memory of 1980 4208 584e1bc286eb8955da6903f90bffe669.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\584e1bc286eb8955da6903f90bffe669.exe"C:\Users\Admin\AppData\Local\Temp\584e1bc286eb8955da6903f90bffe669.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\system.exec:\system.exe2⤵
- Executes dropped EXE
PID:1980
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
373KB
MD5fe18b83899c18dfb79218f48a36e7dc8
SHA163773d8674757f8711b166bc5d3618741e0665c6
SHA256312d4b7381de91eeaea7c6785d92e7de1202e729534789b588c46bcd30fb7132
SHA51223618e5e4e98e58c174954410218d07a393b1a9611443f761bda0101f605dda7431717c95402b652269371628acbf73b261c348fd0f5ff08983c938be14e0f99