Analysis
-
max time kernel
117s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
13-05-2024 12:15
Static task
static1
Behavioral task
behavioral1
Sample
5178a643c03b92ee9b2f9a1545fd560dd712521596d46558dd141ee6e7abc03d.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
5178a643c03b92ee9b2f9a1545fd560dd712521596d46558dd141ee6e7abc03d.exe
Resource
win10v2004-20240508-en
General
-
Target
5178a643c03b92ee9b2f9a1545fd560dd712521596d46558dd141ee6e7abc03d.exe
-
Size
4.1MB
-
MD5
e8268ab92ca9689b603eb923b75a59fd
-
SHA1
cbba2f68e793d3f04b5990ea524612afbfde29bb
-
SHA256
5178a643c03b92ee9b2f9a1545fd560dd712521596d46558dd141ee6e7abc03d
-
SHA512
d7cf70d4d85c857e2e03a2fb8119a5a2fc213fd6c91f463a6b56b2b303150f233291297b051d739f463614e9533ca387ea1fa357678f5f7ab93623ad7beb1e0d
-
SSDEEP
98304:a4L732uynn6mPdqmi3OqVIssVKdzOJDb4v+qd:pKvcZ3OqVcwwN0v+q
Malware Config
Signatures
-
Downloads MZ/PE file
-
Loads dropped DLL 2 IoCs
pid Process 2364 5178a643c03b92ee9b2f9a1545fd560dd712521596d46558dd141ee6e7abc03d.exe 2364 5178a643c03b92ee9b2f9a1545fd560dd712521596d46558dd141ee6e7abc03d.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2364 5178a643c03b92ee9b2f9a1545fd560dd712521596d46558dd141ee6e7abc03d.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2364 5178a643c03b92ee9b2f9a1545fd560dd712521596d46558dd141ee6e7abc03d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5178a643c03b92ee9b2f9a1545fd560dd712521596d46558dd141ee6e7abc03d.exe"C:\Users\Admin\AppData\Local\Temp\5178a643c03b92ee9b2f9a1545fd560dd712521596d46558dd141ee6e7abc03d.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2364
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5431f443b11d753d47156bc5b3fba0b07
SHA19dc1af48b71156b2014c85320da34a550f665513
SHA25666bb7b7e97e7f8c82697f0fce44548abac350541a707e82b79c265660a50f040
SHA512ab66f8eb21b08298255fcab805483cdf4a8fc46d08220af580394b16de0462256efd489b97002fbf68fc04794dd425e40cf13a334210f6497a4352994e290505
-
Filesize
1KB
MD5ac0d3671fbb777c9633a506887f6d9e5
SHA17a05dbf9c1f72a54c0ddf326eda6050009e3c712
SHA2568bf6cc4355d2449831fb5ab71af9f0aa07e1ace9d71e5ddc3179a63ecd912efa
SHA512fe29ef25d225517ea6a71b5a3e903d265b02f695ab9969edcc18b32ea0444c7f441daa9cc3d20d6d6d64761577732570f2521b0a98a79b92b866bd0d941d51bc
-
Filesize
38B
MD52c7fdcfb90d194dbe90ad02168953943
SHA1ab4cd7ba46e770b51cf149c5c155ff92f95fb542
SHA256c4a9448c4969a30e051bd08a32546a6ac1ad80025f44f9b3958d534a95191bbe
SHA512377e755b8ba8a08ed1d02bf83daf52fff27140dc59b09acccba3841bc7f4f1c992ad76780899445714fedaf378ed6220b8530dd0eb82cb0db81d9c6a14558a1d