Analysis
-
max time kernel
137s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 01:56
Behavioral task
behavioral1
Sample
f991f902206d04b5013d8cf65903043b0112ea60704a10d7ba93a3ad8e7754ae.exe
Resource
win7-20240419-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
f991f902206d04b5013d8cf65903043b0112ea60704a10d7ba93a3ad8e7754ae.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
f991f902206d04b5013d8cf65903043b0112ea60704a10d7ba93a3ad8e7754ae.exe
-
Size
8.4MB
-
MD5
6d888f6f8a28d124b1451f58d41e03e4
-
SHA1
6886b3215cb764a1284240d07504d74aac6bead1
-
SHA256
f991f902206d04b5013d8cf65903043b0112ea60704a10d7ba93a3ad8e7754ae
-
SHA512
fe7ad8a16f53d77f4f0831260198783bc9d9c369d195cec7c983314d065bb4f28623e48991e3ea140b25c6dee45869c6e8ef3f3b8ab3bfec40c0d115896372c4
-
SSDEEP
196608:MxcCCRhBa323NSQ6In0+KwyrqB+Y7KPhdGP3g7sSp:MxsRu32x6InXyHY7KhdGvg7v
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/5016-0-0x0000000000400000-0x00000000017C0000-memory.dmp vmprotect behavioral2/memory/5016-2-0x0000000000400000-0x00000000017C0000-memory.dmp vmprotect behavioral2/memory/5016-10-0x0000000000400000-0x00000000017C0000-memory.dmp vmprotect -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5016 f991f902206d04b5013d8cf65903043b0112ea60704a10d7ba93a3ad8e7754ae.exe 5016 f991f902206d04b5013d8cf65903043b0112ea60704a10d7ba93a3ad8e7754ae.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5016 f991f902206d04b5013d8cf65903043b0112ea60704a10d7ba93a3ad8e7754ae.exe 5016 f991f902206d04b5013d8cf65903043b0112ea60704a10d7ba93a3ad8e7754ae.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f991f902206d04b5013d8cf65903043b0112ea60704a10d7ba93a3ad8e7754ae.exe"C:\Users\Admin\AppData\Local\Temp\f991f902206d04b5013d8cf65903043b0112ea60704a10d7ba93a3ad8e7754ae.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5016