Analysis
- max time kernel
122s - max time network
123s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system - submitted
14/06/2024, 01:28
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
9311f9bbf8d4203d216e45c547d3c40073048d15cd1bd4107a1d51daa3602e47.exe
Resource
win7-20231129-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
9311f9bbf8d4203d216e45c547d3c40073048d15cd1bd4107a1d51daa3602e47.exe
Resource
win10v2004-20240611-en
3 signatures
150 seconds
General
- Target 9311f9bbf8d4203d216e45c547d3c40073048d15cd1bd4107a1d51daa3602e47.exe
- Size 6.3MB
- Sample240614-bv7lystdpj
- SHA256 9311f9bbf8d4203d216e45c547d3c40073048d15cd1bd4107a1d51daa3602e47
- MD5 3357bb9ff04c3171af213f02c1b75034
- SHA1 88e236658287002bd93210ba8c86e275c8508cbf
- SHA512 cfadd5000ef03aba20c208662e3e53b688b76c355f804741153ae0a9f1b28cc82cc295345dfbea8a491229bc041dbea9274487dc1bc9fd2c794ff3e96a4626b5
- SSDEEP 98304:aJXND9Xorl4TuyQfpjM/7ZbPZN13MpiRtrKieE5ZevkJprO:Ssk8pY/7ZBPVKpKevWpq
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 3040 9311f9bbf8d4203d216e45c547d3c40073048d15cd1bd4107a1d51daa3602e47.exe 3040 9311f9bbf8d4203d216e45c547d3c40073048d15cd1bd4107a1d51daa3602e47.exe - Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3040 9311f9bbf8d4203d216e45c547d3c40073048d15cd1bd4107a1d51daa3602e47.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3040 9311f9bbf8d4203d216e45c547d3c40073048d15cd1bd4107a1d51daa3602e47.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3040 9311f9bbf8d4203d216e45c547d3c40073048d15cd1bd4107a1d51daa3602e47.exe 3040 9311f9bbf8d4203d216e45c547d3c40073048d15cd1bd4107a1d51daa3602e47.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9311f9bbf8d4203d216e45c547d3c40073048d15cd1bd4107a1d51daa3602e47.exe"C:\Users\Admin\AppData\Local\Temp\9311f9bbf8d4203d216e45c547d3c40073048d15cd1bd4107a1d51daa3602e47.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3040
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path \Users\Admin\AppData\Local\Temp\E2EECore.3.3.9.dll
- Size 10.6MB
- SHA256 c58e066a293ff260037487d37e37bf3d890c16383d817c7573dab51c514cbd00
- MD5 50c266e46ccf9bc8956279f78d51f205
- SHA1 0ba5b98a91a9a019cd9b87cf01796c65ee6a0839
- SHA512 7350a82820faeba3172fad3d87b04c6a2967b797a321a78a53e7156c37fed4661a66d2f78e2f3ddbcbc0d10a56f5d761f7eb761f05d2841568b34841c17e0d37
- SSDEEP 196608:tWqOnbKxQggWXn3M4ggbT6xY8AojRGxhGwipOW2QaNuCV7PQi:tmnbKSggW7bT6xBAYg6vpOW2Qa8eQi
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\iext1.fnr.bbs.125.la
- Size 544KB
- SHA256 1a90ed1033b4efd63299b389af948cc209531ce29de204b24552de59251a8fdf
- MD5 7568384741228f507442fcbfd2ba4d0b
- SHA1 e4aa3772f6022bad7f4d1936be60f7266086cc5e
- SHA512 f4a911b6b91a1162554dc43d038c369d85ae4eec7cdc7e0b5faca00f4f94862ae10414c4797300ac8d61904eb4afcc1126304de2e296291d4db4f79203d4fc1b
- SSDEEP 12288:DZiKuWLsuHboO1ySL0EIEAZXSYQEgyTiYck8D0O8Ns0b0049:DEKuW38OxLGJQEpTSk8Z8aH049
- MD5 SHA1 SHA512 SSDEEP