Analysis
-
max time kernel
96s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-02-2024 14:02
Behavioral task
behavioral1
Sample
Built(vm).exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Built(vm).exe
Resource
win10v2004-20240221-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
>���Z _.pyc
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
>���Z _.pyc
Resource
win10v2004-20240221-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
Built(vm).exe
-
Size
7.3MB
-
MD5
42f725c808fd2e3dbfbc7ef87c13d4ee
-
SHA1
f4ab4e4481b1e17009186c79643ba04f4f4c6332
-
SHA256
cd4a3a88c82594a17a79dbc3db61216d29724ceb1cdd1420b1ee0cc47abcfff7
-
SHA512
8753ffb0c672c3cb966322aad1ea88e4e1c571ea45a4280eb75ad497b611a221c40b9ab1094cf3883649170eba3c08ac8970ec8c5335e5a8ee8bec988f2c4045
-
SSDEEP
196608:whYS6wsOshoKMuIkhVastRL5Di3uh1D7JJ:cYSqOshouIkPftRL54YRJJ
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2564 Built(vm).exe -
resource yara_rule behavioral1/files/0x0005000000019559-21.dat upx behavioral1/files/0x0005000000019559-22.dat upx behavioral1/memory/2564-23-0x000007FEF5560000-0x000007FEF5B49000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2480 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2480 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2264 wrote to memory of 2564 2264 Built(vm).exe 28 PID 2264 wrote to memory of 2564 2264 Built(vm).exe 28 PID 2264 wrote to memory of 2564 2264 Built(vm).exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Built(vm).exe"C:\Users\Admin\AppData\Local\Temp\Built(vm).exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\Built(vm).exe"C:\Users\Admin\AppData\Local\Temp\Built(vm).exe"2⤵
- Loads dropped DLL
PID:2564
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2480
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD55f6fd64ec2d7d73ae49c34dd12cedb23
SHA1c6e0385a868f3153a6e8879527749db52dce4125
SHA256ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967
SHA512c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab
-
Filesize
1.5MB
MD56dfa916fadb72a8e487906cdb6cfd816
SHA10bf8aba436c0b07f8bc352c7349f2617c978ac67
SHA25617f11e52f3dcc450e98fa9909d50fff4b7541078c585ffc71652a1a34682ec9b
SHA51267f3d2e3ba7a927ee83f4f4e9afa6e3bb6157e704f0f6f8face506689720adc8884b904499ae4a7aff3b75fcd4f3a1e95b27a3faa1b8e9ba773dea915ef460eb