Analysis
-
max time kernel
141s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
23-05-2024 02:12
General
-
Target
eb0b75756287fb3038fbcd2cc4cd261ec83dd8fd0fca3acabb12d4565ba8cddd.xlam
-
Size
7.9MB
-
MD5
ad90e16ea4a9fe11525da7669cb4b8ee
-
SHA1
5889a54eeb9eb49e6410d4b26e9140c5af8c4f47
-
SHA256
eb0b75756287fb3038fbcd2cc4cd261ec83dd8fd0fca3acabb12d4565ba8cddd
-
SHA512
11f8b757b8f6f2aa9948524e5d35c157c22c222f31896a4a2406685573efb7fb79833d98e5ce6754e483b6c9796e1a0617da5dc64c894747ee71354adf49cb24
-
SSDEEP
196608:wTid8Kxg1WpeO1dhIHtciobcve1sI7nvkLFTwMpKLibsOHx9S7HF:qid8KxgSJ1dhQciobcM37nvsTwMpKAva
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 21 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\eb0b75756287fb3038fbcd2cc4cd261ec83dd8fd0fca3acabb12d4565ba8cddd.xlam"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\vhcrvdh iobv.scr"C:\Users\Admin\Documents\vhcrvdh iobv.scr" "2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.9MB
MD5ad90e16ea4a9fe11525da7669cb4b8ee
SHA15889a54eeb9eb49e6410d4b26e9140c5af8c4f47
SHA256eb0b75756287fb3038fbcd2cc4cd261ec83dd8fd0fca3acabb12d4565ba8cddd
SHA51211f8b757b8f6f2aa9948524e5d35c157c22c222f31896a4a2406685573efb7fb79833d98e5ce6754e483b6c9796e1a0617da5dc64c894747ee71354adf49cb24
-
Filesize
26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
-
Filesize
327KB
MD5ac5d452f7c5d96be4b7b6379e15ab240
SHA1a1e9f7a99afb9ec56b2c0ae6b732264e3537e777
SHA2564e98d62080776fd6e2a7489345da6c6bf92ac4079e35064e0dee97b32616d899
SHA512c9d7abc08b91103778d498e132bc43f1a476e996acfee75f20ef4d262e69fbcd236355d1ccd68dc1e96e7b1b354f7a428f4d0b5c29df6415a239e467ca2e5aef
-
Filesize
22.4MB
MD5e6f4bb8ed235f43cb738447fbf1757c3
SHA13204c545dd425de58fc0c56ba60a3de952536f1a
SHA2566bcc3e6c23017d7246352c2db0eb13bde264a7252a3ec6ae6e44714c1cbbd970
SHA51227f6b720bef6e9b855e3f10cae73f6aa70820502b84b85060bb2515ba598eedb5566c6012e26e0b25bf62f8b788399eda5649983b3a9058eb3c0b883354fc1de
-
Filesize
11KB
MD54166a122e5eac964ba9f4b22e2881052
SHA12c0836146efecbae5abefd91e8b450252f1ccb1b
SHA25603472796e5add20b57cc1c9453dc000abb3f258e7cf6db8978c524c9cb7e1a15
SHA5128e67101ce63d64da103e653673835ed2c6c74f60c029c06546ec836e904e6ece1ce51cfb620d34ec626d03410e561ef2a5aab9e06a0371478739b5b84633be84
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
22.4MB