Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/01/2024, 07:13

General

  • Target

    584e1bc286eb8955da6903f90bffe669.exe

  • Size

    804KB

  • MD5

    584e1bc286eb8955da6903f90bffe669

  • SHA1

    6cfd818d147a78d5a43e9e06070cfb74f6748745

  • SHA256

    c142d9820ded00be039a926a070dbbc1d8a748313a3fac67ad379600e67a1449

  • SHA512

    d1e5cbf8d2b412059bcfbd5cce9b312575bd3ad8f4c14c9884092a41222a13b7a15807be85ed6e638acced9f9c0fbc43599f16fab491b48aaed2c7315570253b

  • SSDEEP

    24576:YOWsrPXzaGZteD0Mi+iuasv1tl3HwUpmZ:YFmPpU0Mi+l93QQmZ

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\584e1bc286eb8955da6903f90bffe669.exe
    "C:\Users\Admin\AppData\Local\Temp\584e1bc286eb8955da6903f90bffe669.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4208
    • \??\c:\system.exe
      c:\system.exe
      2⤵
      • Executes dropped EXE
      PID:1980

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\system.exe

          Filesize

          373KB

          MD5

          fe18b83899c18dfb79218f48a36e7dc8

          SHA1

          63773d8674757f8711b166bc5d3618741e0665c6

          SHA256

          312d4b7381de91eeaea7c6785d92e7de1202e729534789b588c46bcd30fb7132

          SHA512

          23618e5e4e98e58c174954410218d07a393b1a9611443f761bda0101f605dda7431717c95402b652269371628acbf73b261c348fd0f5ff08983c938be14e0f99

        • memory/1980-7-0x0000000002300000-0x0000000002301000-memory.dmp

          Filesize

          4KB

        • memory/1980-9-0x0000000000400000-0x0000000000463000-memory.dmp

          Filesize

          396KB

        • memory/4208-0-0x0000000000400000-0x00000000004C9000-memory.dmp

          Filesize

          804KB

        • memory/4208-14-0x0000000000400000-0x00000000004C9000-memory.dmp

          Filesize

          804KB