Analysis
-
max time kernel
151s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
11-02-2024 20:10
Behavioral task
behavioral1
Sample
StormLab.exe
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
General
-
Target
StormLab.exe
-
Size
17.1MB
-
MD5
f9b3595c5af5b703f6db357971b255be
-
SHA1
a6b0ea5f0786e27cf3f5f77989b7c1fed20dfa92
-
SHA256
fd1f60a5cf3be939a1bd01fd88e0aca5243b1c1336227b092ae0b64d4bacf929
-
SHA512
7ab31e854438dd937efb3df3b698eee4e62b305ff96788771a053411a0aad35a50c1beefb67ec6541ccac201552b2056adac339440b2b744ab80871f9232a891
-
SSDEEP
393216:liIE7YoPQJRHi+2ohcyLbdQuslSl99oWOv+9f+TWZXNfpg:K7rPQnHiRyc0bdQu9DorvS2T49p
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1016 StormLab.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2440 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2440 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe 2440 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1912 wrote to memory of 1016 1912 StormLab.exe 28 PID 1912 wrote to memory of 1016 1912 StormLab.exe 28 PID 1912 wrote to memory of 1016 1912 StormLab.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\StormLab.exe"C:\Users\Admin\AppData\Local\Temp\StormLab.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\StormLab.exe"C:\Users\Admin\AppData\Local\Temp\StormLab.exe"2⤵
- Loads dropped DLL
PID:1016
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2440
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.3MB
MD5deaf0c0cc3369363b800d2e8e756a402
SHA13085778735dd8badad4e39df688139f4eed5f954
SHA256156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d
SHA5125cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989