39e1780e7003dfbeb31a0b0c1d1c9c72c7eeaafa30cd1408757b9ceb56916e93 | Triage

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 15:28

Sharing

Report Analysis Logs

General

Target

TKLord.exe
Size

128KB
MD5

38c8fa7c3ffa3b28dda7b3eb83d60d3b
SHA1

527ee22d5fa6997abf0cec31f4efc756bfecc0f3
SHA256

623cbe4ab3a3c1e1ed85cabf12eb0a8e3d52880e513ea92742356ecbf320f8a4
SHA512

9f14da3f1b4074c9d2170c607fa958db42d4d80fde3ae370c549656fa05e79c5e440e039057c4e5348fc416bb01be9370499fdcfe840c2466de86f27689c390e
SSDEEP

1536:CHGwpIKPQZP/l3biuTJX+iKcqbiuTJX+iKc:Cmwil3biuTJX+iKRbiuTJX+iK

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3064	TKGC.exe
3064	TKGC.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 3064	2788	TKLord.exe	28
PID 2788 wrote to memory of 3064	2788	TKLord.exe	28
PID 2788 wrote to memory of 3064	2788	TKLord.exe	28
PID 2788 wrote to memory of 3064	2788	TKLord.exe	28

C:\Users\Admin\AppData\Local\Temp\TKLord.exe
"C:\Users\Admin\AppData\Local\Temp\TKLord.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Users\Admin\AppData\Local\Temp\TKGC.exe
  C:\Users\Admin\AppData\Local\Temp\TKGC.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads