Overview

overview

7

Static

static

3

91feaea84b...c3.exe

windows7-x64

7

91feaea84b...c3.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    145s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/03/2024, 02:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    91feaea84b71d070741145c5eac50bc3.exe

  • Size

    418KB

  • MD5

    91feaea84b71d070741145c5eac50bc3

  • SHA1

    8ece71d309b95c4bb473cefa526c48f611f89d9d

  • SHA256

    a2e9445a358b14de773a3195b56753ae662cc3174974aeb27fa272e648ab24c2

  • SHA512

    eb671788eb5cb789bb922304ce03b04e1fe719ce9360b5df5c40ee1c87af14764815cbbd0ba0f907afde467cf3320019856bbe47df7f8757ae08157097f27ef5

  • SSDEEP

    12288:KplrVbDdQaqdS/ofraFErH8uB2Wm0SX/Nr5FU:mxRQ+Fucuvm0a/

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\91feaea84b71d070741145c5eac50bc3.exe
    "C:\Users\Admin\AppData\Local\Temp\91feaea84b71d070741145c5eac50bc3.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4416
    • C:\Program Files\Framework\skipto.exe
      "C:\Program Files\Framework\skipto.exe" "33201"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:4124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Framework\skipto.exe
    Filesize

    419KB

    MD5

    c786946fd288a21df3b8add73409d16b

    SHA1

    1492c3376b74c0a70a1aadfadf8bd12a393b9cca

    SHA256

    aa39174cdd0d1c9e8ed75d367ebdd707bffc0710d734e1713c573b146b534191

    SHA512

    77885fa164857e45fea059f99c57980044ce97e136f72da5c43460bf4c41d2a718ea60724a1dad182808cd7bfd339153465e89c92ee5b94f7bcb83419ee660a5

    Download Submit

  • memory/4124-5-0x0000000000400000-0x0000000000573000-memory.dmp

    Filesize

    1.4MB

    Download

  • memory/4124-7-0x0000000000400000-0x0000000000573000-memory.dmp

    Filesize

    1.4MB

    Download

  • memory/4416-0-0x0000000000400000-0x0000000000573000-memory.dmp

    Filesize

    1.4MB

    Download

  • memory/4416-6-0x0000000000400000-0x0000000000573000-memory.dmp

    Filesize

    1.4MB

    Download