471b1264bcc332dcfa69187ff322df257d039bc2503765fec497b3b5fdbda0e9 | Triage

Analysis

max time kernel
1742s
max time network
1176s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 00:53

Sharing

Report Analysis Logs

General

Target

BlitzedGrabberX96/Bin/leaf.exe
Size

18KB
MD5

2a62b2d78f2c0f2efd39f07641d231e1
SHA1

30e17f27edb951a306fd907e37aacc170bf3c7be
SHA256

b4b1dd5fc206b0089ca1e7d613d6475a9a06bbcf4c207830d7c0cf02a94ae79a
SHA512

4246bb79753f803aaeef24ec6bb9f5ec23859f2cc24d3cfb58c901722cd089b98cf8a2eae6763d18f1a2a330f71887aa8dfbfbd2bb92865680c2f1135a371ca5
SSDEEP

384:F4DIh6WG5tV+xSjdto26g2S0olp6NaUkBq2CimESaz+kz:6DIhK3gG/6rsYjEJSkz

Score

7^/10

Malware Config

Signatures

Drops startup file 2 IoCs

Processes:

leaf.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\leaf.exe	leaf.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\leaf.exe	leaf.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

leaf.exe

pid process

4640 leaf.exe

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberX96\Bin\leaf.exe
"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberX96\Bin\leaf.exe"
1⤵
- Drops startup file
- Suspicious behavior: AddClipboardFormatListener
PID:4640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4640-0-0x00007FFEC98C3000-0x00007FFEC98C5000-memory.dmp

Filesize
8KB

Download
memory/4640-1-0x00000000005D0000-0x00000000005DC000-memory.dmp

Filesize
48KB

Download
memory/4640-4-0x00007FFEC98C0000-0x00007FFECA381000-memory.dmp

Filesize
10.8MB

Download
memory/4640-5-0x00007FFEC98C0000-0x00007FFECA381000-memory.dmp

Filesize
10.8MB

Download