Analysis
-
max time kernel
146s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16-06-2024 03:50
Static task
static1
Behavioral task
behavioral1
Sample
7510ae911623d3ff65919eb760da36a29d44f4b9e3886a65973b0ed914eaa0fe.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7510ae911623d3ff65919eb760da36a29d44f4b9e3886a65973b0ed914eaa0fe.exe
Resource
win10v2004-20240508-en
General
-
Target
7510ae911623d3ff65919eb760da36a29d44f4b9e3886a65973b0ed914eaa0fe.exe
-
Size
1.3MB
-
MD5
2b73fc0d060261a5b10d6ae9befa9971
-
SHA1
cf333b92396ad6149224b3f96e3d55c02c1362f0
-
SHA256
7510ae911623d3ff65919eb760da36a29d44f4b9e3886a65973b0ed914eaa0fe
-
SHA512
5ec26fcaa9e88a48e31b424943e8bee01afa624559ece8a68a23a508cb5a7dc31facc5cd49cde43586fe1b6d026e53a1c2d4eef7bcea0122dda27b3328edbeb7
-
SSDEEP
24576:+8AxwjemyxgBq6Cvi3L3PwYcwQKsiK3/T+dk:+8Axwje5GqHipcl33/T
Malware Config
Extracted
risepro
147.45.47.126:58709
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
Processes:
7510ae911623d3ff65919eb760da36a29d44f4b9e3886a65973b0ed914eaa0fe.exepid process 1796 7510ae911623d3ff65919eb760da36a29d44f4b9e3886a65973b0ed914eaa0fe.exe 1796 7510ae911623d3ff65919eb760da36a29d44f4b9e3886a65973b0ed914eaa0fe.exe 1796 7510ae911623d3ff65919eb760da36a29d44f4b9e3886a65973b0ed914eaa0fe.exe 1796 7510ae911623d3ff65919eb760da36a29d44f4b9e3886a65973b0ed914eaa0fe.exe 1796 7510ae911623d3ff65919eb760da36a29d44f4b9e3886a65973b0ed914eaa0fe.exe 1796 7510ae911623d3ff65919eb760da36a29d44f4b9e3886a65973b0ed914eaa0fe.exe 1796 7510ae911623d3ff65919eb760da36a29d44f4b9e3886a65973b0ed914eaa0fe.exe 1796 7510ae911623d3ff65919eb760da36a29d44f4b9e3886a65973b0ed914eaa0fe.exe 1796 7510ae911623d3ff65919eb760da36a29d44f4b9e3886a65973b0ed914eaa0fe.exe 1796 7510ae911623d3ff65919eb760da36a29d44f4b9e3886a65973b0ed914eaa0fe.exe 1796 7510ae911623d3ff65919eb760da36a29d44f4b9e3886a65973b0ed914eaa0fe.exe 1796 7510ae911623d3ff65919eb760da36a29d44f4b9e3886a65973b0ed914eaa0fe.exe 1796 7510ae911623d3ff65919eb760da36a29d44f4b9e3886a65973b0ed914eaa0fe.exe 1796 7510ae911623d3ff65919eb760da36a29d44f4b9e3886a65973b0ed914eaa0fe.exe 1796 7510ae911623d3ff65919eb760da36a29d44f4b9e3886a65973b0ed914eaa0fe.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
7510ae911623d3ff65919eb760da36a29d44f4b9e3886a65973b0ed914eaa0fe.exepid process 1796 7510ae911623d3ff65919eb760da36a29d44f4b9e3886a65973b0ed914eaa0fe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7510ae911623d3ff65919eb760da36a29d44f4b9e3886a65973b0ed914eaa0fe.exe"C:\Users\Admin\AppData\Local\Temp\7510ae911623d3ff65919eb760da36a29d44f4b9e3886a65973b0ed914eaa0fe.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:1796
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1796-0-0x0000000000C50000-0x0000000001182000-memory.dmpFilesize
5.2MB
-
memory/1796-2-0x00000000010E4000-0x0000000001182000-memory.dmpFilesize
632KB
-
memory/1796-1-0x0000000000C50000-0x0000000001182000-memory.dmpFilesize
5.2MB
-
memory/1796-4-0x0000000000C50000-0x0000000001182000-memory.dmpFilesize
5.2MB
-
memory/1796-5-0x0000000000C50000-0x0000000001182000-memory.dmpFilesize
5.2MB
-
memory/1796-6-0x0000000000C50000-0x0000000001182000-memory.dmpFilesize
5.2MB
-
memory/1796-7-0x0000000000C50000-0x0000000001182000-memory.dmpFilesize
5.2MB
-
memory/1796-8-0x0000000000C50000-0x0000000001182000-memory.dmpFilesize
5.2MB
-
memory/1796-9-0x0000000000C50000-0x0000000001182000-memory.dmpFilesize
5.2MB
-
memory/1796-10-0x0000000000C50000-0x0000000001182000-memory.dmpFilesize
5.2MB
-
memory/1796-11-0x0000000000C50000-0x0000000001182000-memory.dmpFilesize
5.2MB
-
memory/1796-12-0x0000000000C50000-0x0000000001182000-memory.dmpFilesize
5.2MB
-
memory/1796-13-0x0000000000C50000-0x0000000001182000-memory.dmpFilesize
5.2MB
-
memory/1796-14-0x0000000000C50000-0x0000000001182000-memory.dmpFilesize
5.2MB
-
memory/1796-15-0x0000000000C50000-0x0000000001182000-memory.dmpFilesize
5.2MB
-
memory/1796-16-0x0000000000C50000-0x0000000001182000-memory.dmpFilesize
5.2MB
-
memory/1796-17-0x0000000000C50000-0x0000000001182000-memory.dmpFilesize
5.2MB
-
memory/1796-18-0x0000000000C50000-0x0000000001182000-memory.dmpFilesize
5.2MB