aa6e3a3f06fbf1a9b6fd3c03afd97abb83adcaa63e68bf41e83fe0ff2aff02e1 | Triage

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 23:30

Sharing

Report Analysis Logs

General

Target

AutoGuarder2.3.7.350/kill_meex.exe
Size

221KB
MD5

92c60822422b69ef1768df00a717b182
SHA1

a5ef6d12c2bbff7bc158bc7e453e284b5afde693
SHA256

c6e7a4cd21060a9be006db4c48845db8323099c1994ab68b12653595b224344b
SHA512

5f25d6c198e24f6c6abaa3192ad592795eafcc67ee9948c66bf56333e374f07405127015cd9aecbe0fce1198020f4191549cfcfaa99b483b82461841cbefc0da
SSDEEP

6144:ASRA69G3SCSNMtYsuiDRq17uGGYcw9WbLKBNd:a69GCCnuGWuGGY

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral15/memory/2568-0-0x0000000000400000-0x0000000000488000-memory.dmp	upx
behavioral15/memory/2568-1-0x0000000000400000-0x0000000000488000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2568	kill_meex.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2568	kill_meex.exe
2568	kill_meex.exe

C:\Users\Admin\AppData\Local\Temp\AutoGuarder2.3.7.350\kill_meex.exe
"C:\Users\Admin\AppData\Local\Temp\AutoGuarder2.3.7.350\kill_meex.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2568-0-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2568-1-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download