Analysis

  • max time kernel
    141s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    22-05-2024 22:33

General

  • Target

    89bbf517312beff500c2638c56763325b4bdd8c0910026cbe494e3eb133c89ab.exe

  • Size

    9.9MB

  • MD5

    4c5c35e9a66cc7ff4209786cf6469aaa

  • SHA1

    684dadd1457f053cef13ee70b9000b20b400e2fe

  • SHA256

    89bbf517312beff500c2638c56763325b4bdd8c0910026cbe494e3eb133c89ab

  • SHA512

    ea7923c7803eb6b64287d67aab922d84fb84a834c17793b45ca48a7c5e56557ff0f52725a1096e2413cfad2a0eb2e7e9c7da9248748a19e9500699dca95f3ed6

  • SSDEEP

    196608:HAydYJbaogx4gdotFLFNZhKKWfkDaQ1B8Ui1YtOXLLadsqS:puHg+gWtFh1fWsDaGB8UMko6dsq

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\89bbf517312beff500c2638c56763325b4bdd8c0910026cbe494e3eb133c89ab.exe
    "C:\Users\Admin\AppData\Local\Temp\89bbf517312beff500c2638c56763325b4bdd8c0910026cbe494e3eb133c89ab.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:2880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\ExuiKrnln_Win32_20230819.lib

    Filesize

    1.6MB

    MD5

    a1df3b7884c175c967505a589ba51da2

    SHA1

    7aaf570e41a00149134973d00f4efc09c4b650c2

    SHA256

    c16014329cf6f242a525f6782dd10f6a4d0ff6f97239710fdc45522f5c6da525

    SHA512

    12b8bd05fd9bec79d643edb503634b8b5238c67c77ddd8d2c3220406c08b1e6197e8aff02c709e353bc4ce9353a6709837b81ca443660250d94e73c00d66f451

  • \Users\Admin\AppData\Local\Temp\f760c12.tmp

    Filesize

    333KB

    MD5

    56a2bcecbd3cddd6f4a35361bf4920d6

    SHA1

    992e63be423f0e61093ba183f49fc0cbec790488

    SHA256

    5fcfac18758a12e0e717a5189f379922a32b5ac12f26491e638d70b54ae1dcab

    SHA512

    473cbdf760242db1f0f1d0c27046c0564998f2bf931ad03feb28af3c7bd253d00e6f0836dadf37f29e0db4171eb64e6a15ed4cb9a9d28b48fb0aab601573f551

  • memory/2880-9-0x0000000073C82000-0x0000000073C96000-memory.dmp

    Filesize

    80KB

  • memory/2880-12-0x0000000061080000-0x0000000061119000-memory.dmp

    Filesize

    612KB

  • memory/2880-13-0x0000000073C82000-0x0000000073C96000-memory.dmp

    Filesize

    80KB