Analysis
-
max time kernel
100s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/04/2024, 19:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
balamod-v0.1.11-windows.exe
Resource
win10v2004-20240226-en
7 signatures
150 seconds
General
-
Target
balamod-v0.1.11-windows.exe
-
Size
8.2MB
-
MD5
d194a51f786491f5fc0787209109abb0
-
SHA1
59c77ef1167f2bf8c4f9abcd7494cefb4a84f012
-
SHA256
9cf4cf3e844c661f665c7590ef7f2d5eddc98266d96ee49be848fc74763a752a
-
SHA512
2ca03242cb12f3743908a5d2e7f4e019bd2f50bc9c851b15e21d8ced6e711bad1761f7cf960a94b54073a63d9203f7edd7878f64ed86a81b59e2bc8f79ed3bc0
-
SSDEEP
98304:F2XuPw0YYLLvBV4yzQAaQLKMzYOZ4ZBZveDgUAgV0:ux0j4tQmMp4ZCu
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 528 vlc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3660 mspaint.exe 3660 mspaint.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 528 vlc.exe -
Suspicious use of FindShellTrayWindow 9 IoCs
pid Process 528 vlc.exe 528 vlc.exe 528 vlc.exe 528 vlc.exe 528 vlc.exe 528 vlc.exe 528 vlc.exe 528 vlc.exe 528 vlc.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 528 vlc.exe 528 vlc.exe 528 vlc.exe 528 vlc.exe 528 vlc.exe 528 vlc.exe 528 vlc.exe 528 vlc.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 3660 mspaint.exe 3660 mspaint.exe 3660 mspaint.exe 3660 mspaint.exe 528 vlc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\balamod-v0.1.11-windows.exe"C:\Users\Admin\AppData\Local\Temp\balamod-v0.1.11-windows.exe"1⤵PID:808
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\SplitRegister.dib"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3660
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:1508
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ProtectUnlock.mov"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:528