Overview
overview
10Static
static
10IDA Pro 8....re.dll
windows11-21h2-x64
1IDA Pro 8....ui.dll
windows11-21h2-x64
1IDA Pro 8....rt.dll
windows11-21h2-x64
1IDA Pro 8....vg.dll
windows11-21h2-x64
1IDA Pro 8....ts.dll
windows11-21h2-x64
1IDA Pro 8....ch.vbs
windows11-21h2-x64
1IDA Pro 8....64.dll
windows11-21h2-x64
1IDA Pro 8....server
windows11-21h2-x64
1IDA Pro 8....rver64
windows11-21h2-x64
1IDA Pro 8....server
windows11-21h2-x64
1IDA Pro 8....server
windows11-21h2-x64
1IDA Pro 8....server
windows11-21h2-x64
1IDA Pro 8....server
windows11-21h2-x64
1IDA Pro 8....rver64
windows11-21h2-x64
1IDA Pro 8....server
windows11-21h2-x64
1IDA Pro 8....rver64
windows11-21h2-x64
1IDA Pro 8...._arm64
windows11-21h2-x64
1IDA Pro 8....arm64e
windows11-21h2-x64
1IDA Pro 8....te.exe
windows11-21h2-x64
1IDA Pro 8....64.exe
windows11-21h2-x64
1IDA Pro 8....da.dll
windows11-21h2-x64
1IDA Pro 8....da.exe
windows11-21h2-x64
1IDA Pro 8....ida.js
windows11-21h2-x64
3IDA Pro 8....64.dll
windows11-21h2-x64
1IDA Pro 8....64.exe
windows11-21h2-x64
1IDA Pro 8....lp.chm
windows11-21h2-x64
1IDA Pro 8....ch.exe
windows11-21h2-x64
1IDA Pro 8....at.exe
windows11-21h2-x64
1IDA Pro 8....64.exe
windows11-21h2-x64
1IDA Pro 8....ida.js
windows11-21h2-x64
3IDA Pro 8....e17.js
windows11-21h2-x64
3IDA Pro 8....mic.js
windows11-21h2-x64
3Analysis
-
max time kernel
138s -
max time network
156s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
14-07-2024 18:46
Behavioral task
behavioral1
Sample
IDA Pro 8.3 (x86_ x86_64)/Qt5Core.dll
Resource
win11-20240709-en
Behavioral task
behavioral2
Sample
IDA Pro 8.3 (x86_ x86_64)/Qt5Gui.dll
Resource
win11-20240709-en
Behavioral task
behavioral3
Sample
IDA Pro 8.3 (x86_ x86_64)/Qt5PrintSupport.dll
Resource
win11-20240709-en
Behavioral task
behavioral4
Sample
IDA Pro 8.3 (x86_ x86_64)/Qt5Svg.dll
Resource
win11-20240709-en
Behavioral task
behavioral5
Sample
IDA Pro 8.3 (x86_ x86_64)/Qt5Widgets.dll
Resource
win11-20240709-en
Behavioral task
behavioral6
Sample
IDA Pro 8.3 (x86, x86_64)/cfg/gdb_arch.vbs
Resource
win11-20240709-en
Behavioral task
behavioral7
Sample
IDA Pro 8.3 (x86_ x86_64)/clp64.dll
Resource
win11-20240709-en
Behavioral task
behavioral8
Sample
IDA Pro 8.3 (x86, x86_64)/dbgsrv/android_server
Resource
win11-20240709-en
Behavioral task
behavioral9
Sample
IDA Pro 8.3 (x86, x86_64)/dbgsrv/android_server64
Resource
win11-20240709-en
Behavioral task
behavioral10
Sample
IDA Pro 8.3 (x86, x86_64)/dbgsrv/android_x64_server
Resource
win11-20240709-en
Behavioral task
behavioral11
Sample
IDA Pro 8.3 (x86, x86_64)/dbgsrv/android_x86_server
Resource
win11-20240709-en
Behavioral task
behavioral12
Sample
IDA Pro 8.3 (x86, x86_64)/dbgsrv/armlinux_server
Resource
win11-20240709-en
Behavioral task
behavioral13
Sample
IDA Pro 8.3 (x86, x86_64)/dbgsrv/linux_server
Resource
win11-20240709-en
Behavioral task
behavioral14
Sample
IDA Pro 8.3 (x86, x86_64)/dbgsrv/linux_server64
Resource
win11-20240709-en
Behavioral task
behavioral15
Sample
IDA Pro 8.3 (x86, x86_64)/dbgsrv/mac_server
Resource
win11-20240709-en
Behavioral task
behavioral16
Sample
IDA Pro 8.3 (x86, x86_64)/dbgsrv/mac_server64
Resource
win11-20240709-en
Behavioral task
behavioral17
Sample
IDA Pro 8.3 (x86, x86_64)/dbgsrv/mac_server_arm64
Resource
win11-20240709-en
Behavioral task
behavioral18
Sample
IDA Pro 8.3 (x86, x86_64)/dbgsrv/mac_server_arm64e
Resource
win11-20240709-en
Behavioral task
behavioral19
Sample
IDA Pro 8.3 (x86, x86_64)/dbgsrv/win32_remote.exe
Resource
win11-20240709-en
Behavioral task
behavioral20
Sample
IDA Pro 8.3 (x86, x86_64)/dbgsrv/win64_remote64.exe
Resource
win11-20240709-en
Behavioral task
behavioral21
Sample
IDA Pro 8.3 (x86_ x86_64)/ida.dll
Resource
win11-20240709-en
Behavioral task
behavioral22
Sample
IDA Pro 8.3 (x86, x86_64)/ida.exe
Resource
win11-20240709-en
Behavioral task
behavioral23
Sample
IDA Pro 8.3 (x86, x86_64)/ida.js
Resource
win11-20240709-en
Behavioral task
behavioral24
Sample
IDA Pro 8.3 (x86_ x86_64)/ida64.dll
Resource
win11-20240709-en
Behavioral task
behavioral25
Sample
IDA Pro 8.3 (x86, x86_64)/ida64.exe
Resource
win11-20240709-en
Behavioral task
behavioral26
Sample
IDA Pro 8.3 (x86, x86_64)/idahelp.chm
Resource
win11-20240709-en
Behavioral task
behavioral27
Sample
IDA Pro 8.3 (x86, x86_64)/idapyswitch.exe
Resource
win11-20240709-en
Behavioral task
behavioral28
Sample
IDA Pro 8.3 (x86, x86_64)/idat.exe
Resource
win11-20240709-en
Behavioral task
behavioral29
Sample
IDA Pro 8.3 (x86, x86_64)/idat64.exe
Resource
win11-20240709-en
Behavioral task
behavioral30
Sample
IDA Pro 8.3 (x86, x86_64)/idc/ida.js
Resource
win11-20240709-en
Behavioral task
behavioral31
Sample
IDA Pro 8.3 (x86, x86_64)/plugins/hexrays_sdk/plugins/vds17/hexrays_sample17.js
Resource
win11-20240709-en
Behavioral task
behavioral32
Sample
IDA Pro 8.3 (x86, x86_64)/plugins/hexrays_sdk/verifier/showmic.js
Resource
win11-20240709-en
General
-
Target
IDA Pro 8.3 (x86, x86_64)/ida.exe
-
Size
4.0MB
-
MD5
05c7e465d9d88e94e064a99dc36f4ce1
-
SHA1
e87ccd7bcfa05a30aa283c5e5953ba368ff75bed
-
SHA256
d2650a12440bdc4f1b34456956221764c249060e808194b79152e9f679dd4e85
-
SHA512
a9af650ea3518f88c5f8d9e1d059fd039c88d70b733ccec4107f75b14b6d9489a79dffa3ff5fbd7343ebeeb0ae90d26cdac64b79da006b5cb0c25316a66aacc4
-
SSDEEP
49152:5MPnm/Zi34DKYj0ZkO4+XTcSq8EQtezdGfPko7FjOeBfDMmpwfFcnQOh6H6RBvV9:5smOqjcXA0nexReBv6avGBXMi+7Wg
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
ida.exepid process 1292 ida.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AUDIODG.EXEdescription pid process Token: 33 4308 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4308 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ida.exepid process 1292 ida.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\IDA Pro 8.3 (x86, x86_64)\ida.exe"C:\Users\Admin\AppData\Local\Temp\IDA Pro 8.3 (x86, x86_64)\ida.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1292
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004D81⤵
- Suspicious use of AdjustPrivilegeToken
PID:4308