Analysis

  • max time kernel
    142s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    03-06-2024 12:41

General

  • Target

    8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe

  • Size

    14.9MB

  • MD5

    2e58d70bb2ba90b46df2bcbc4e6a08ba

  • SHA1

    0c59dd1c80e0993d73645f5e3e09c3554f7faf1f

  • SHA256

    8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac

  • SHA512

    c556bf08a2530bc9feaf6e9074cada739a18a27f7c7a75f89945d68ddbc7b1cdbfbd8e69098b7cdcde76047119e3586cce65f345beb8de08992d7680ef715c1d

  • SSDEEP

    196608:VzwoVmUuCvh7pQoXhQET1AIx53YJbaogxWVmVxH5/AuS:xVmUuy7p7XhN5VIHgkVmbH5/AuS

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe
    "C:\Users\Admin\AppData\Local\Temp\8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1732
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\Restart.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2656
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • Runs ping.exe
        PID:2736
      • C:\Users\Admin\AppData\Local\Temp\8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe
        "C:\Users\Admin\AppData\Local\Temp\8B0634~1.EXE"
        3⤵
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:3048

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Restart.bat

    Filesize

    113B

    MD5

    978d3afcd430e12574940784a306a930

    SHA1

    476b59fa345bf72049c53e7b9c0766d6cd6e30c0

    SHA256

    ca9869f8c04e523c71b628ca941151ef51428985506fd47130dddf859fde2220

    SHA512

    970212ea574c05a7db2e622a3d5a1929dd7d2006d7e1fc780c9428372b2b9b58f851f4082bf3a9d0727bb72b92abcdb9aded071dd42ad2aecb2fd15fb7d59512

  • C:\Users\Admin\AppData\Local\Temp\font_temp.ttf

    Filesize

    8.0MB

    MD5

    092a99ee52bbaef7481cc96c5b85b992

    SHA1

    06b8475f99605af9ff9ff3ed1d0eb907fd57c06b

    SHA256

    b3f675ccfc65edd6f27432dec6639b1414e9dc627831791263a99e2d711d215d

    SHA512

    3538cebe1c0e2439c7ba289c4420627d59b4922e26242408f114aa01d342734b057d92edac35bee7c47cb926091695efc6c560802db0cd342f75cee1f8b96baf

  • \Users\Admin\AppData\Local\Temp\ExuiKrnln_Win32_20230725.lib

    Filesize

    1.6MB

    MD5

    a081782e61d769dcd299bb7672aed743

    SHA1

    78d4795bb43ad2b949192b09987b17eba156dced

    SHA256

    34ece32d4bf3dab02772326afd2e5d8d1f28d7c5be6379c3d40875a03345bafa

    SHA512

    e7384eab27e866284071709f90097db8a6bc630d5dee8b102a0f4a6b9af9a70797209bd50d00ed28899ee4628b937f44cf2eb8d5518562b3c37925ad53704ab0

  • \Users\Admin\AppData\Local\Temp\f7608d7.tmp

    Filesize

    333KB

    MD5

    56a2bcecbd3cddd6f4a35361bf4920d6

    SHA1

    992e63be423f0e61093ba183f49fc0cbec790488

    SHA256

    5fcfac18758a12e0e717a5189f379922a32b5ac12f26491e638d70b54ae1dcab

    SHA512

    473cbdf760242db1f0f1d0c27046c0564998f2bf931ad03feb28af3c7bd253d00e6f0836dadf37f29e0db4171eb64e6a15ed4cb9a9d28b48fb0aab601573f551

  • memory/3048-35-0x0000000061080000-0x0000000061119000-memory.dmp

    Filesize

    612KB