Analysis
-
max time kernel
92s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2024, 15:58 UTC
Static task
static1
Behavioral task
behavioral1
Sample
5d204c46173e06821cbf13809cdb7a8113b9f84508ec86b0c576e07ecc1be73a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5d204c46173e06821cbf13809cdb7a8113b9f84508ec86b0c576e07ecc1be73a.exe
Resource
win10v2004-20240226-en
General
-
Target
5d204c46173e06821cbf13809cdb7a8113b9f84508ec86b0c576e07ecc1be73a.exe
-
Size
500KB
-
MD5
4e606ec2c539df61d47793d033487456
-
SHA1
a9613340888ba3bd3b9ce16a9ce17f78b962cb2b
-
SHA256
5d204c46173e06821cbf13809cdb7a8113b9f84508ec86b0c576e07ecc1be73a
-
SHA512
a568751d4c0167c9da9cbd23119b0289196b3ba09ff012d67c4a8ffaa307d1e7cae6e00ccbf6589edc9547e148d6fa18a7b670bec263b9b8f3ae83569f7a141d
-
SSDEEP
12288:TgUK9Q0u9pGHNu4B2UoZGgYNWwrcpZ+bDFpPOoNMcq:TgUK9Q0PI4rowgE6p2RdNM
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5036 5d204c46173e06821cbf13809cdb7a8113b9f84508ec86b0c576e07ecc1be73a.exe 5036 5d204c46173e06821cbf13809cdb7a8113b9f84508ec86b0c576e07ecc1be73a.exe
Processes
Network
-
Remote address:8.8.8.8:53Request209.205.72.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request147.111.86.104.in-addr.arpaIN PTRResponse147.111.86.104.in-addr.arpaIN PTRa104-86-111-147deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request19.53.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request149.220.183.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request50.23.12.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request15.164.165.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request41.110.86.104.in-addr.arpaIN PTRResponse41.110.86.104.in-addr.arpaIN PTRa104-86-110-41deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request251.110.86.104.in-addr.arpaIN PTRResponse251.110.86.104.in-addr.arpaIN PTRa104-86-110-251deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request21.236.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request161.111.86.104.in-addr.arpaIN PTRResponse161.111.86.104.in-addr.arpaIN PTRa104-86-111-161deploystaticakamaitechnologiescom
-
72 B 158 B 1 1
DNS Request
209.205.72.20.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
147.111.86.104.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
19.53.126.40.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
104.219.191.52.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
149.220.183.52.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
13.86.106.20.in-addr.arpa
-
70 B 156 B 1 1
DNS Request
50.23.12.20.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
15.164.165.52.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
41.110.86.104.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
251.110.86.104.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
21.236.111.52.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
161.111.86.104.in-addr.arpa