Analysis

  • max time kernel
    143s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-06-2024 12:41

General

  • Target

    8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe

  • Size

    14.9MB

  • MD5

    2e58d70bb2ba90b46df2bcbc4e6a08ba

  • SHA1

    0c59dd1c80e0993d73645f5e3e09c3554f7faf1f

  • SHA256

    8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac

  • SHA512

    c556bf08a2530bc9feaf6e9074cada739a18a27f7c7a75f89945d68ddbc7b1cdbfbd8e69098b7cdcde76047119e3586cce65f345beb8de08992d7680ef715c1d

  • SSDEEP

    196608:VzwoVmUuCvh7pQoXhQET1AIx53YJbaogxWVmVxH5/AuS:xVmUuy7p7XhN5VIHgkVmbH5/AuS

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe
    "C:\Users\Admin\AppData\Local\Temp\8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2060
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\Restart.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4820
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • Runs ping.exe
        PID:5008
      • C:\Users\Admin\AppData\Local\Temp\8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe
        "C:\Users\Admin\AppData\Local\Temp\8B0634~1.EXE"
        3⤵
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:732
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4240,i,18168883380598738769,14202261231630113808,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
    1⤵
      PID:468

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\ExuiKrnln_Win32_20230725.lib

      Filesize

      1.6MB

      MD5

      a081782e61d769dcd299bb7672aed743

      SHA1

      78d4795bb43ad2b949192b09987b17eba156dced

      SHA256

      34ece32d4bf3dab02772326afd2e5d8d1f28d7c5be6379c3d40875a03345bafa

      SHA512

      e7384eab27e866284071709f90097db8a6bc630d5dee8b102a0f4a6b9af9a70797209bd50d00ed28899ee4628b937f44cf2eb8d5518562b3c37925ad53704ab0

    • C:\Users\Admin\AppData\Local\Temp\Restart.bat

      Filesize

      113B

      MD5

      978d3afcd430e12574940784a306a930

      SHA1

      476b59fa345bf72049c53e7b9c0766d6cd6e30c0

      SHA256

      ca9869f8c04e523c71b628ca941151ef51428985506fd47130dddf859fde2220

      SHA512

      970212ea574c05a7db2e622a3d5a1929dd7d2006d7e1fc780c9428372b2b9b58f851f4082bf3a9d0727bb72b92abcdb9aded071dd42ad2aecb2fd15fb7d59512

    • C:\Users\Admin\AppData\Local\Temp\e57e4b3.tmp

      Filesize

      333KB

      MD5

      56a2bcecbd3cddd6f4a35361bf4920d6

      SHA1

      992e63be423f0e61093ba183f49fc0cbec790488

      SHA256

      5fcfac18758a12e0e717a5189f379922a32b5ac12f26491e638d70b54ae1dcab

      SHA512

      473cbdf760242db1f0f1d0c27046c0564998f2bf931ad03feb28af3c7bd253d00e6f0836dadf37f29e0db4171eb64e6a15ed4cb9a9d28b48fb0aab601573f551

    • C:\Users\Admin\AppData\Local\Temp\font_temp.ttf

      Filesize

      8.0MB

      MD5

      092a99ee52bbaef7481cc96c5b85b992

      SHA1

      06b8475f99605af9ff9ff3ed1d0eb907fd57c06b

      SHA256

      b3f675ccfc65edd6f27432dec6639b1414e9dc627831791263a99e2d711d215d

      SHA512

      3538cebe1c0e2439c7ba289c4420627d59b4922e26242408f114aa01d342734b057d92edac35bee7c47cb926091695efc6c560802db0cd342f75cee1f8b96baf

    • memory/732-35-0x0000000061080000-0x0000000061119000-memory.dmp

      Filesize

      612KB