Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
10-04-2024 09:54
General
-
Target
1e9fc7f32bd5522dd0222932eb9f1d8bd0a2e132c7b46cfcc622ad97831e6128.exe
-
Size
352KB
-
MD5
5a7a90ceb6e7137c753d8de226fc7947
-
SHA1
204a603c409e559b65c35208200a169a232da94c
-
SHA256
1e9fc7f32bd5522dd0222932eb9f1d8bd0a2e132c7b46cfcc622ad97831e6128
-
SHA512
a1f8dcf279b0f0b74d4e7890f118bbf27d0c20da75ebb670c0ee41dae6e16eae86c05fea5a6b51756b93360b8965545c3bde76b2beefeebed44a19fa42af79ed
-
SSDEEP
6144:YZZC6Tf4RnqqfjkKlirFW1jGVr9nOhKy0zIBd6CiBP0PfL+eDHSVJs0z9LjS7g:ONTwxIKlirM1jAy0MjPi2Pj+oA/2
Score
10/10
Malware Config
Signatures
-
Detect WinDealer information stealer 5 IoCs
-
WinDealer
WinDealer is an info stealer used by LuoYu group.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e9fc7f32bd5522dd0222932eb9f1d8bd0a2e132c7b46cfcc622ad97831e6128.exe"C:\Users\Admin\AppData\Local\Temp\1e9fc7f32bd5522dd0222932eb9f1d8bd0a2e132c7b46cfcc622ad97831e6128.exe"1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB