Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
05-05-2024 10:21
Behavioral task
behavioral1
Sample
1090cdb860ef354e6f13aa0c53157fcd1573f350f92191f9a3f66313cb225e7e.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1090cdb860ef354e6f13aa0c53157fcd1573f350f92191f9a3f66313cb225e7e.exe
Resource
win10v2004-20240419-en
General
-
Target
1090cdb860ef354e6f13aa0c53157fcd1573f350f92191f9a3f66313cb225e7e.exe
-
Size
3.6MB
-
MD5
5ab1ea1e99956beca943b61b2e792fa0
-
SHA1
d1bc57d58bd06040e663474fb1fea7c912603db1
-
SHA256
1090cdb860ef354e6f13aa0c53157fcd1573f350f92191f9a3f66313cb225e7e
-
SHA512
8f5c7a52729ced920d0c885efe65308710be5286e8ec22b055aadea0e7a8f1d7a441bdd760309a98c4e1cf361cd1fbae908baf83108045fcfb218459fb41fe96
-
SSDEEP
98304:Y4bGG/zm5w68p34Lag2goABnB8G21AcvnhMXXHW2wl9oLCqqnRMqMzM0u2u:YmJNMz
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1920 1090cdb860ef354e6f13aa0c53157fcd1573f350f92191f9a3f66313cb225e7e.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Fonts\fcgcyg.dll 1090cdb860ef354e6f13aa0c53157fcd1573f350f92191f9a3f66313cb225e7e.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 480 Process not Found -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1920 1090cdb860ef354e6f13aa0c53157fcd1573f350f92191f9a3f66313cb225e7e.exe 1920 1090cdb860ef354e6f13aa0c53157fcd1573f350f92191f9a3f66313cb225e7e.exe 1920 1090cdb860ef354e6f13aa0c53157fcd1573f350f92191f9a3f66313cb225e7e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1090cdb860ef354e6f13aa0c53157fcd1573f350f92191f9a3f66313cb225e7e.exe"C:\Users\Admin\AppData\Local\Temp\1090cdb860ef354e6f13aa0c53157fcd1573f350f92191f9a3f66313cb225e7e.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1920
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5736228b33e34445eaf8c16b864294c27
SHA16c77cb3c3f6ed94fc61d03383fa19f09a56b3c77
SHA256c8015c473252a432d131bf2dd53a1172acdc05870de399f4456dce3edbc847cc
SHA5127849dcccc0f59e89930b57b921ad3733816b6f857c2ae0905f6e1e3221603aba9fd382a3f255e76fb06128376f8f9eb79a0a30d4ea8b476d86a0163535644cec