71ce71735aa47a3b1d17e1b6639aaf6213b4c284243ad5ae7bb36fa1c5c9975f

Analysis

max time kernel
146s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 08:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SpyNote_v6.4/SpyNote.exe
Size

6.7MB
MD5

d9265f1d01fe8cfde1b241886e834a8c
SHA1

a5f29b1c2a6f981c246976de1ba7e053841aa562
SHA256

53f32f6ed5e1fbd5f5a29f83ab0eebc385f693824544fa4664242c91c7d9f1bf
SHA512

59fc93e2ba15e8c901216dd2108ddfc3f1b7fa954ba0cc903d684aa4a2353b295c7e5c9f8f20e744de743cff436fee5fd0e96ba1f156a0a681a275f20af85e6b
SSDEEP

196608:2dHPY7vsZ+oa4DuuyrMi8VKe+PMfw7k2c4PAVv1sUpr:+vfZ+IaLM9we+P2myds

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs

Processes:

SpyNote.exe

pid	process
2092	SpyNote.exe
2092	SpyNote.exe
2092	SpyNote.exe
2092	SpyNote.exe
2092	SpyNote.exe
2092	SpyNote.exe
2092	SpyNote.exe
2092	SpyNote.exe
2092	SpyNote.exe
2092	SpyNote.exe
2092	SpyNote.exe
2092	SpyNote.exe
2092	SpyNote.exe
2092	SpyNote.exe
2092	SpyNote.exe
2092	SpyNote.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

SpyNote.exe

pid process

2092 SpyNote.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

SpyNote.exe

pid process

2092 SpyNote.exe

C:\Users\Admin\AppData\Local\Temp\SpyNote_v6.4\SpyNote.exe
"C:\Users\Admin\AppData\Local\Temp\SpyNote_v6.4\SpyNote.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2092

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2092-0-0x0000000000320000-0x0000000001E30000-memory.dmp

Filesize
27.1MB

Download
memory/2092-1-0x0000000000320000-0x0000000001E30000-memory.dmp

Filesize
27.1MB

Download
memory/2092-2-0x0000000000320000-0x0000000001E30000-memory.dmp

Filesize
27.1MB

Download
memory/2092-3-0x0000000007DE0000-0x0000000007F08000-memory.dmp

Filesize
1.2MB

Download
memory/2092-4-0x0000000000320000-0x0000000001E30000-memory.dmp

Filesize
27.1MB

Download
memory/2092-5-0x0000000000320000-0x0000000001E30000-memory.dmp

Filesize
27.1MB

Download
memory/2092-6-0x0000000000320000-0x0000000001E30000-memory.dmp

Filesize
27.1MB

Download
memory/2092-7-0x0000000000320000-0x0000000001E30000-memory.dmp

Filesize
27.1MB

Download
memory/2092-8-0x0000000000320000-0x0000000001E30000-memory.dmp

Filesize
27.1MB

Download
memory/2092-9-0x0000000000320000-0x0000000001E30000-memory.dmp

Filesize
27.1MB

Download
memory/2092-10-0x0000000000320000-0x0000000001E30000-memory.dmp

Filesize
27.1MB

Download
memory/2092-11-0x0000000000320000-0x0000000001E30000-memory.dmp

Filesize
27.1MB

Download
memory/2092-12-0x0000000000320000-0x0000000001E30000-memory.dmp

Filesize
27.1MB

Download
memory/2092-13-0x0000000000320000-0x0000000001E30000-memory.dmp

Filesize
27.1MB

Download
memory/2092-14-0x0000000000320000-0x0000000001E30000-memory.dmp

Filesize
27.1MB

Download
memory/2092-15-0x0000000000320000-0x0000000001E30000-memory.dmp

Filesize
27.1MB

Download
memory/2092-16-0x0000000000320000-0x0000000001E30000-memory.dmp

Filesize
27.1MB

Download
memory/2092-17-0x0000000000320000-0x0000000001E30000-memory.dmp

Filesize
27.1MB

Download
memory/2092-18-0x0000000000320000-0x0000000001E30000-memory.dmp

Filesize
27.1MB

Download
memory/2092-19-0x0000000000320000-0x0000000001E30000-memory.dmp

Filesize
27.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads