Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
25/06/2024, 14:38
Behavioral task
behavioral1
Sample
8789e57686701757f939ce177fd17dba23988ad887f2def150c35d55094ecb14.exe
Resource
win7-20240419-en
4 signatures
150 seconds
General
-
Target
8789e57686701757f939ce177fd17dba23988ad887f2def150c35d55094ecb14.exe
-
Size
11.0MB
-
MD5
de6e4d9473b012d380ca710619c12ba2
-
SHA1
bd19d48729edea9ba2389a28539e6bd52e7b7ed9
-
SHA256
8789e57686701757f939ce177fd17dba23988ad887f2def150c35d55094ecb14
-
SHA512
ebc4edc416f642afd91620cadb606bbec3c35541d0ad620de6d9cdeb1a4cb8ace5a3fc8bc19d495726a6e1135b7576100b2e48617df11b2ff40fdc05a2f70e7a
-
SSDEEP
196608:zTtDT7dYxpIZ9LzKYPcy/ZkeLeDLAXHL3TSjGM9OtQRClEtNGDATJxCik7Ov:f17dYx2ZlvP1KzLiDTSj7OqwS1xfkCv
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2396-64-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2396-62-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2396-60-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2396-58-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2396-56-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2396-54-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2396-52-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2396-50-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2396-48-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2396-46-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2396-44-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2396-43-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2396-42-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2396-41-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2396-39-0x0000000010000000-0x000000001003E000-memory.dmp upx -
resource yara_rule behavioral1/memory/2396-35-0x0000000000400000-0x00000000027D5000-memory.dmp vmprotect behavioral1/memory/2396-85-0x0000000000400000-0x00000000027D5000-memory.dmp vmprotect behavioral1/memory/2396-86-0x0000000000400000-0x00000000027D5000-memory.dmp vmprotect behavioral1/memory/2396-87-0x0000000000400000-0x00000000027D5000-memory.dmp vmprotect -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2396 8789e57686701757f939ce177fd17dba23988ad887f2def150c35d55094ecb14.exe 2396 8789e57686701757f939ce177fd17dba23988ad887f2def150c35d55094ecb14.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2396 8789e57686701757f939ce177fd17dba23988ad887f2def150c35d55094ecb14.exe 2396 8789e57686701757f939ce177fd17dba23988ad887f2def150c35d55094ecb14.exe 2396 8789e57686701757f939ce177fd17dba23988ad887f2def150c35d55094ecb14.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8789e57686701757f939ce177fd17dba23988ad887f2def150c35d55094ecb14.exe"C:\Users\Admin\AppData\Local\Temp\8789e57686701757f939ce177fd17dba23988ad887f2def150c35d55094ecb14.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2396