Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-02-2024 13:16
Behavioral task
behavioral1
Sample
Creal.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
General
-
Target
Creal.exe
-
Size
14.3MB
-
MD5
491748f8c5178012f8f497a8fb9860d5
-
SHA1
3514f3ba1d9cef9c42777652288dc7512799539c
-
SHA256
15d971e7e9e6bbceea6f9fe3c39a63c119720b3b2c709e81f709484c06129dc5
-
SHA512
4d7244a15d6d414e893510e10e88b1813823f824b7096ef9fdf4b907babd5123de79e31a9330caa0b00420b5c73eeca48750e4133dd49a9493ae5847f92dd3c7
-
SSDEEP
393216:niIE7YoPQPndQuslSq9RoWOv+9fgynkUWXwf:87rPQPndQuSborvSYynUXw
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2480 Creal.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1880 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1880 taskmgr.exe -
Suspicious use of FindShellTrayWindow 37 IoCs
pid Process 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe -
Suspicious use of SendNotifyMessage 37 IoCs
pid Process 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2480 2196 Creal.exe 28 PID 2196 wrote to memory of 2480 2196 Creal.exe 28 PID 2196 wrote to memory of 2480 2196 Creal.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Creal.exe"C:\Users\Admin\AppData\Local\Temp\Creal.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\Creal.exe"C:\Users\Admin\AppData\Local\Temp\Creal.exe"2⤵
- Loads dropped DLL
PID:2480
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1200
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1880
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.3MB
MD5deaf0c0cc3369363b800d2e8e756a402
SHA13085778735dd8badad4e39df688139f4eed5f954
SHA256156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d
SHA5125cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989