Analysis
-
max time kernel
79s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-06-2024 09:43
Static task
static1
Behavioral task
behavioral1
Sample
49251ce8afa14d8f060df72c7e07ac5531234a690cf197f93441b022feebd3d0.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
49251ce8afa14d8f060df72c7e07ac5531234a690cf197f93441b022feebd3d0.exe
Resource
win10v2004-20240508-en
General
-
Target
49251ce8afa14d8f060df72c7e07ac5531234a690cf197f93441b022feebd3d0.exe
-
Size
10.7MB
-
MD5
25200df62d2e1d8acc721b13d67159f2
-
SHA1
46a668636420594057fd4419c67e62c96421ba51
-
SHA256
49251ce8afa14d8f060df72c7e07ac5531234a690cf197f93441b022feebd3d0
-
SHA512
098567a4c5b69bc0769b1d95c481b8c312499a9bf7bdf81e9cc8edc97d7619d3157d9e46ac467e8d6270414ccb0560de4c128f007df492984289f2d2133db033
-
SSDEEP
196608:bZwskicu8/nLTUr900IP1TxV0hii9IY9o4quO2h5mqIx7cmU4w+Ffz:bZw7fu8/nMCtxVoii9IY9os5mqShw6
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1456-4-0x0000000003FC0000-0x0000000004561000-memory.dmp upx behavioral2/memory/1456-5-0x0000000003FC0000-0x0000000004561000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1456 49251ce8afa14d8f060df72c7e07ac5531234a690cf197f93441b022feebd3d0.exe 1456 49251ce8afa14d8f060df72c7e07ac5531234a690cf197f93441b022feebd3d0.exe 1456 49251ce8afa14d8f060df72c7e07ac5531234a690cf197f93441b022feebd3d0.exe 1456 49251ce8afa14d8f060df72c7e07ac5531234a690cf197f93441b022feebd3d0.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1456 49251ce8afa14d8f060df72c7e07ac5531234a690cf197f93441b022feebd3d0.exe 1456 49251ce8afa14d8f060df72c7e07ac5531234a690cf197f93441b022feebd3d0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\49251ce8afa14d8f060df72c7e07ac5531234a690cf197f93441b022feebd3d0.exe"C:\Users\Admin\AppData\Local\Temp\49251ce8afa14d8f060df72c7e07ac5531234a690cf197f93441b022feebd3d0.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1456