Analysis
-
max time kernel
143s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
22/04/2024, 20:13
Static task
static1
Behavioral task
behavioral1
Sample
2c2b104a65116e06e1f242dc06570ee2a735e2966f32370dd2d45a16afdc3808.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2c2b104a65116e06e1f242dc06570ee2a735e2966f32370dd2d45a16afdc3808.exe
Resource
win10v2004-20240412-en
General
-
Target
2c2b104a65116e06e1f242dc06570ee2a735e2966f32370dd2d45a16afdc3808.exe
-
Size
403KB
-
MD5
02534c2b586fa1924e6a7442fb265b06
-
SHA1
0aa8a4db94897a3b6bb746be6484857cfac964f5
-
SHA256
2c2b104a65116e06e1f242dc06570ee2a735e2966f32370dd2d45a16afdc3808
-
SHA512
abd885bbbdcb7203c344813d2789b75d7ec995498b240582fbcdb7da3369408e4ba087ddac375f10ac645a549f350f4d147f72ca707b968f7fb619275ca9aec5
-
SSDEEP
6144:LmFGXZPh1n0s3/UnG+3DW+QkcUrIvbYpNbouI8kzjJ7Hvv:LmFGXZPh1n0s8nG+DWnkc2YgNb08c
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1572 depend.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\that\depend.exe 2c2b104a65116e06e1f242dc06570ee2a735e2966f32370dd2d45a16afdc3808.exe File opened for modification C:\Program Files\that\depend.exe 2c2b104a65116e06e1f242dc06570ee2a735e2966f32370dd2d45a16afdc3808.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4368 2c2b104a65116e06e1f242dc06570ee2a735e2966f32370dd2d45a16afdc3808.exe 4368 2c2b104a65116e06e1f242dc06570ee2a735e2966f32370dd2d45a16afdc3808.exe 4368 2c2b104a65116e06e1f242dc06570ee2a735e2966f32370dd2d45a16afdc3808.exe 4368 2c2b104a65116e06e1f242dc06570ee2a735e2966f32370dd2d45a16afdc3808.exe 1572 depend.exe 1572 depend.exe 1572 depend.exe 1572 depend.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4368 wrote to memory of 1572 4368 2c2b104a65116e06e1f242dc06570ee2a735e2966f32370dd2d45a16afdc3808.exe 84 PID 4368 wrote to memory of 1572 4368 2c2b104a65116e06e1f242dc06570ee2a735e2966f32370dd2d45a16afdc3808.exe 84 PID 4368 wrote to memory of 1572 4368 2c2b104a65116e06e1f242dc06570ee2a735e2966f32370dd2d45a16afdc3808.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c2b104a65116e06e1f242dc06570ee2a735e2966f32370dd2d45a16afdc3808.exe"C:\Users\Admin\AppData\Local\Temp\2c2b104a65116e06e1f242dc06570ee2a735e2966f32370dd2d45a16afdc3808.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Program Files\that\depend.exe"C:\Program Files\that\depend.exe" "33201"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1572
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
403KB
MD53d0675451bab98d12713d2e6203bb611
SHA1619cb2c0febf7628c337e0ad97b328dd671fa448
SHA256f2b740be172faccf261ac89eaaff5a85f02df0f540f6546c9025993755d7fba8
SHA51295d0f75467fbafa9c0fc63c1fd153e3de4c97ce77b4a1529abbdd4abc0ef7f0aa92b996d4c9189c45ab4f623ecce61c821b71e80cacffb04f4ebeb7c1d84d859