Analysis
-
max time kernel
117s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
10-04-2024 09:27
General
-
Target
08530e8280a93b8a1d51c20647e6be73795ef161e3b16e22e5e23d88ead4e226.exe
-
Size
360KB
-
MD5
ef25d934d12684b371a17c76daf3662c
-
SHA1
b062773bdd9f8433cbd6e7642226221972ecd4e1
-
SHA256
08530e8280a93b8a1d51c20647e6be73795ef161e3b16e22e5e23d88ead4e226
-
SHA512
68ed0239b1daa2c99515574dcec8a5ab8d5a0cf289f815b84ea4ccfc21033465cea42ac34e3e29189612deb04150b4ceed37e0dcba53b4a62b68cc6eb4a26d1e
-
SSDEEP
6144:nSX2CRpQA+THkWCmfL4R8J8plnnA2JcVRlnaLbT3oe+E1PG40H58Yhb:iXRpQ9THkWCmC8JQA2JeRlaz9G40H5tb
Score
10/10
Malware Config
Signatures
-
Detect WinDealer information stealer 6 IoCs
-
WinDealer
WinDealer is an info stealer used by LuoYu group.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\08530e8280a93b8a1d51c20647e6be73795ef161e3b16e22e5e23d88ead4e226.exe"C:\Users\Admin\AppData\Local\Temp\08530e8280a93b8a1d51c20647e6be73795ef161e3b16e22e5e23d88ead4e226.exe"1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB