Analysis
-
max time kernel
1792s -
max time network
1521s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/02/2024, 21:47
Static task
static1
Behavioral task
behavioral1
Sample
ursa-cli.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ursa-cli.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
ursa-qt.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
ursa-qt.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
ursad.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
ursad.exe
Resource
win10v2004-20240226-en
General
-
Target
ursa-qt.exe
-
Size
40.8MB
-
MD5
359f7a80152a4082e422f533c1486b52
-
SHA1
b21f69d5daff341f70113e3890f15f46ca7093db
-
SHA256
723e1a4ca9154db0135f47dadd7cbefe6ec14c9de3070285544e8b838965b6eb
-
SHA512
430c5a1b6f1ade4ea38fbf275e15c8f232ae016700e46bcf1aed53cc0f1a4877a7ba91e0f2fcbe719286c90f54ac2828cf4dbecafe527fa622b66b2a5eeee737
-
SSDEEP
393216:E/u4cSOOOQPzqqitP4GkE1l13P9wQgQmv0xJsv6tWKFdu9CmUS3x:e1NOOXPzWtP4GJ13q7zZ
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2336 ursa-qt.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2336 ursa-qt.exe 2336 ursa-qt.exe 2336 ursa-qt.exe 2336 ursa-qt.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2336 ursa-qt.exe 2336 ursa-qt.exe