Overview
overview
3Static
static
3AutoHotkey
windows7-x64
1AutoHotkey
windows10-2004-x64
1AutoHotkey.exe
windows7-x64
1AutoHotkey.exe
windows10-2004-x64
1Execute.txt
windows7-x64
1Execute.txt
windows10-2004-x64
1Gettype.txt
windows7-x64
1Gettype.txt
windows10-2004-x64
1Invoke.txt
windows7-x64
1Invoke.txt
windows10-2004-x64
1NewPE2.txt
windows7-x64
1NewPE2.txt
windows10-2004-x64
1SMOSA.vbs
windows7-x64
3SMOSA.vbs
windows10-2004-x64
3getMethod.txt
windows7-x64
1getMethod.txt
windows10-2004-x64
1load.txt
windows7-x64
1load.txt
windows10-2004-x64
1msg.txt
windows7-x64
1msg.txt
windows10-2004-x64
1node.bat
windows7-x64
3node.bat
windows10-2004-x64
3run.js
windows7-x64
3run.js
windows10-2004-x64
3runpe.txt
windows7-x64
1runpe.txt
windows10-2004-x64
1Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 10:10
Static task
static1
Behavioral task
behavioral1
Sample
AutoHotkey
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
AutoHotkey
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
AutoHotkey.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
AutoHotkey.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
Execute.txt
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
Execute.txt
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
Gettype.txt
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Gettype.txt
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
Invoke.txt
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Invoke.txt
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
NewPE2.txt
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
NewPE2.txt
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
SMOSA.vbs
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
SMOSA.vbs
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
getMethod.txt
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
getMethod.txt
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
load.txt
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
load.txt
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
msg.txt
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
msg.txt
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
node.bat
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
node.bat
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
run.js
Resource
win7-20240419-en
Behavioral task
behavioral24
Sample
run.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
runpe.txt
Resource
win7-20240508-en
Behavioral task
behavioral26
Sample
runpe.txt
Resource
win10v2004-20240508-en
General
-
Target
AutoHotkey
-
Size
339B
-
MD5
2312ab36e3363bfa8f217c14354aba68
-
SHA1
736c5cb239a94007863c03c68705b890fd051302
-
SHA256
c53105c99521502a13e4dd32fa591a52b4b35026c68de86aa34f68532ff94769
-
SHA512
dcd58e38538b9aee53fa4d9b51e563e4e42bf9c7763d2094261b3de11dd21617bcb4bb8c39f86da9409c84b2b0e52a17a56a4aa1c832a0df47201576fd91860b
Malware Config
Signatures
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 2904 AutoHotkey.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2700 wrote to memory of 2904 2700 cmd.exe 29 PID 2700 wrote to memory of 2904 2700 cmd.exe 29 PID 2700 wrote to memory of 2904 2700 cmd.exe 29 PID 2700 wrote to memory of 2904 2700 cmd.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\AutoHotkey1⤵
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\AutoHotkey.exeC:\Users\Admin\AppData\Local\Temp\AutoHotkey2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2904
-