Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22/04/2024, 20:13
Static task
static1
Behavioral task
behavioral1
Sample
2c2b104a65116e06e1f242dc06570ee2a735e2966f32370dd2d45a16afdc3808.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2c2b104a65116e06e1f242dc06570ee2a735e2966f32370dd2d45a16afdc3808.exe
Resource
win10v2004-20240412-en
General
-
Target
2c2b104a65116e06e1f242dc06570ee2a735e2966f32370dd2d45a16afdc3808.exe
-
Size
403KB
-
MD5
02534c2b586fa1924e6a7442fb265b06
-
SHA1
0aa8a4db94897a3b6bb746be6484857cfac964f5
-
SHA256
2c2b104a65116e06e1f242dc06570ee2a735e2966f32370dd2d45a16afdc3808
-
SHA512
abd885bbbdcb7203c344813d2789b75d7ec995498b240582fbcdb7da3369408e4ba087ddac375f10ac645a549f350f4d147f72ca707b968f7fb619275ca9aec5
-
SSDEEP
6144:LmFGXZPh1n0s3/UnG+3DW+QkcUrIvbYpNbouI8kzjJ7Hvv:LmFGXZPh1n0s8nG+DWnkc2YgNb08c
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1508 function.exe -
Loads dropped DLL 2 IoCs
pid Process 2236 2c2b104a65116e06e1f242dc06570ee2a735e2966f32370dd2d45a16afdc3808.exe 2236 2c2b104a65116e06e1f242dc06570ee2a735e2966f32370dd2d45a16afdc3808.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\depend\function.exe 2c2b104a65116e06e1f242dc06570ee2a735e2966f32370dd2d45a16afdc3808.exe File opened for modification C:\Program Files\depend\function.exe 2c2b104a65116e06e1f242dc06570ee2a735e2966f32370dd2d45a16afdc3808.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2236 2c2b104a65116e06e1f242dc06570ee2a735e2966f32370dd2d45a16afdc3808.exe 2236 2c2b104a65116e06e1f242dc06570ee2a735e2966f32370dd2d45a16afdc3808.exe 2236 2c2b104a65116e06e1f242dc06570ee2a735e2966f32370dd2d45a16afdc3808.exe 2236 2c2b104a65116e06e1f242dc06570ee2a735e2966f32370dd2d45a16afdc3808.exe 1508 function.exe 1508 function.exe 1508 function.exe 1508 function.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2236 wrote to memory of 1508 2236 2c2b104a65116e06e1f242dc06570ee2a735e2966f32370dd2d45a16afdc3808.exe 28 PID 2236 wrote to memory of 1508 2236 2c2b104a65116e06e1f242dc06570ee2a735e2966f32370dd2d45a16afdc3808.exe 28 PID 2236 wrote to memory of 1508 2236 2c2b104a65116e06e1f242dc06570ee2a735e2966f32370dd2d45a16afdc3808.exe 28 PID 2236 wrote to memory of 1508 2236 2c2b104a65116e06e1f242dc06570ee2a735e2966f32370dd2d45a16afdc3808.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c2b104a65116e06e1f242dc06570ee2a735e2966f32370dd2d45a16afdc3808.exe"C:\Users\Admin\AppData\Local\Temp\2c2b104a65116e06e1f242dc06570ee2a735e2966f32370dd2d45a16afdc3808.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Program Files\depend\function.exe"C:\Program Files\depend\function.exe" "33201"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1508
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
403KB
MD5b0983cd4a9d1f575197f58bab735a6f2
SHA1f2a116fde57af90aa597fb2b1e9b867033d40f2c
SHA2560c5f613662919c576177e8ac80f0b165c92ae071dde57c5f4ed3cb85f746c022
SHA51249df3f41eb6105c931fa5e6c457c9ac3d9c636ebe0a121d69733f70c01b1ca3358344f9ca7677b3a4cbebdb98d572709045c82efc4bbff89a920dfeebf912d3e