cea71996a0b6d827728465345d79c4c9cdffd6656cc99e9e17436a3fe3ee3403 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 01:15

Sharing

Report Analysis Logs

General

Target

262cd9fb206dcc24ca299aca5d73e2e7.exe
Size

426KB
MD5

262cd9fb206dcc24ca299aca5d73e2e7
SHA1

f038008a1e2ab293b82ddb39315442d44bc07cb8
SHA256

cea71996a0b6d827728465345d79c4c9cdffd6656cc99e9e17436a3fe3ee3403
SHA512

d111c56fc710a99fdfdb64de1de2d86787bb68f0fadd95f378e426e6aa052d373848946b185cbffa5ff80705baaec39ed0941c5f654769f564a2754ee6c58a47
SSDEEP

12288:2plrVbDdQaqdS/ofraFErH8uB2Wm0SXsNr5FU:SxRQ+Fucuvm0as

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1716	verify.exe

Loads dropped DLL 2 IoCs

pid	Process
2040	262cd9fb206dcc24ca299aca5d73e2e7.exe
2040	262cd9fb206dcc24ca299aca5d73e2e7.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\code\verify.exe	262cd9fb206dcc24ca299aca5d73e2e7.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2040	262cd9fb206dcc24ca299aca5d73e2e7.exe
2040	262cd9fb206dcc24ca299aca5d73e2e7.exe
2040	262cd9fb206dcc24ca299aca5d73e2e7.exe
2040	262cd9fb206dcc24ca299aca5d73e2e7.exe
1716	verify.exe
1716	verify.exe
1716	verify.exe
1716	verify.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1716	2040	262cd9fb206dcc24ca299aca5d73e2e7.exe	28
PID 2040 wrote to memory of 1716	2040	262cd9fb206dcc24ca299aca5d73e2e7.exe	28
PID 2040 wrote to memory of 1716	2040	262cd9fb206dcc24ca299aca5d73e2e7.exe	28
PID 2040 wrote to memory of 1716	2040	262cd9fb206dcc24ca299aca5d73e2e7.exe	28

C:\Users\Admin\AppData\Local\Temp\262cd9fb206dcc24ca299aca5d73e2e7.exe
"C:\Users\Admin\AppData\Local\Temp\262cd9fb206dcc24ca299aca5d73e2e7.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Program Files\code\verify.exe
  "C:\Program Files\code\verify.exe" "33201"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files\code\verify.exe

Filesize
426KB

MD5
46c25ea538ad4deac5c2c3e691edbca9

SHA1
fdaa3e0a8d8852f618d87a572f6eef44a513c2cc

SHA256
b7176e4f24ec371d6da7c2d53f6bfa77d152cfc651a20f5a2f9c9ba748e021b2

SHA512
03e00ee5927ef87538b90c5f1e567b9a0e7e1edee6aaf5e02ec59a7241b7627f6f9a346868486fc3230964a85829acbb1d21d57ec66cf53d4c690d8caa0e4470

Download Submit