Analysis
-
max time kernel
14s -
max time network
35s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13-03-2024 18:51
Static task
static1
Behavioral task
behavioral1
Sample
c69e49df79c2094385e68ccd4aadb114.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c69e49df79c2094385e68ccd4aadb114.exe
Resource
win10v2004-20240226-en
General
-
Target
c69e49df79c2094385e68ccd4aadb114.exe
-
Size
3.5MB
-
MD5
c69e49df79c2094385e68ccd4aadb114
-
SHA1
d3f3e70efa98a0b32bcf2f92a89938bf79b9c7cd
-
SHA256
abb811be0eda380d4023da9caafa4ed4c18cc094033747472a2cc662e170faf6
-
SHA512
89740188945c537d7f692e7d1acdb28c9d0e4c70db4a746c6bed6a4304538fd186564ea4c6c6f0b6bc626d665fb12d3985df6211fd7a85901da6bbcc26db4e27
-
SSDEEP
24576:+7QFRUm/rCYAj8pXU+Cz/rVCY4C0hrVCY4C0G4C0SY4C0G4CT0l:EQFRHrmQG+yrV2FhrV2FTFGFTvl
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2348 y.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2348 y.exe 2348 y.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 116 wrote to memory of 2348 116 c69e49df79c2094385e68ccd4aadb114.exe 96 PID 116 wrote to memory of 2348 116 c69e49df79c2094385e68ccd4aadb114.exe 96 PID 116 wrote to memory of 2348 116 c69e49df79c2094385e68ccd4aadb114.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\c69e49df79c2094385e68ccd4aadb114.exe"C:\Users\Admin\AppData\Local\Temp\c69e49df79c2094385e68ccd4aadb114.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\y.exeC:\Users\Admin\AppData\Local\Temp\y.exe -run C:\Users\Admin\AppData\Local\Temp\c69e49df79c2094385e68ccd4aadb114.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2348
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD53bb4d0bf9a67e385c70ef6b7f94f9ae8
SHA18e4119d6a16b6918be7b271fbbe2f08b604e859c
SHA2561af3410d0ab8f711754b9c203717f3bdfe5640799f84870de90de7716119e427
SHA5125fe8eb1abb3c64ebeab8f1733249a63b94347465a0503d817cc8a1a1f68f1d87c1bc82c8e6341e511816ccf6075135c8c64109a40ee75491c5cbe666f4214346
-
Filesize
1.4MB
MD5dbb403d16dfdb7e9393127e32838e5b2
SHA19c1e93f6b4bffb5535920700c3ddd85ecee18435
SHA2569a16bc37f042bb59951e9b0b860fa67c6875d0a548bd751ca2f518d7b0ac8dd1
SHA512ee2ce17e2d0027254e856d043721e9d5e4ee86281f33e069014c6e50e0c8e7468828fe2882f66942ca3a8ccbafec645c11aa158178829e9cc6af962fbd2fb31c