Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
20/07/2024, 17:52
Static task
static1
Behavioral task
behavioral1
Sample
24b12e42316e3a235165420260063ee31505f9977f4902d910086e471a0eb13c.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
24b12e42316e3a235165420260063ee31505f9977f4902d910086e471a0eb13c.exe
Resource
win10v2004-20240709-en
General
-
Target
24b12e42316e3a235165420260063ee31505f9977f4902d910086e471a0eb13c.exe
-
Size
1.6MB
-
MD5
907141b445126d4f881a4e785b65418d
-
SHA1
92140a4560ccd8632bd3964b0d2dd51a81e58baa
-
SHA256
24b12e42316e3a235165420260063ee31505f9977f4902d910086e471a0eb13c
-
SHA512
caf3cecca9b94c07141b59bb0003611671129d387d8c0643d25b2e423c316ccc275ea1abfb2c014a2bf25d013663719d79236e241cd6fa47d5b8fc9b0bc9ad4e
-
SSDEEP
24576:FWjs/VnznmHtdR0KIHTmn37shQs2dSGs0ED0ICvK/rAI:FWjs/sHtD5IHTmn3Fsx0Eycn
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 4408 24b12e42316e3a235165420260063ee31505f9977f4902d910086e471a0eb13c.exe -
resource yara_rule behavioral2/memory/4408-0-0x0000000002300000-0x000000000230B000-memory.dmp upx behavioral2/memory/4408-2-0x0000000002300000-0x000000000230B000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4408 24b12e42316e3a235165420260063ee31505f9977f4902d910086e471a0eb13c.exe 4408 24b12e42316e3a235165420260063ee31505f9977f4902d910086e471a0eb13c.exe 4408 24b12e42316e3a235165420260063ee31505f9977f4902d910086e471a0eb13c.exe 4408 24b12e42316e3a235165420260063ee31505f9977f4902d910086e471a0eb13c.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4408 24b12e42316e3a235165420260063ee31505f9977f4902d910086e471a0eb13c.exe 4408 24b12e42316e3a235165420260063ee31505f9977f4902d910086e471a0eb13c.exe 4408 24b12e42316e3a235165420260063ee31505f9977f4902d910086e471a0eb13c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\24b12e42316e3a235165420260063ee31505f9977f4902d910086e471a0eb13c.exe"C:\Users\Admin\AppData\Local\Temp\24b12e42316e3a235165420260063ee31505f9977f4902d910086e471a0eb13c.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4408
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
892KB
MD592849a63d136bcbdc7e2def718f25237
SHA132abf6345009816ea6234e3581d3d2a922ca467d
SHA25646f7490e9c9b08aaf416e72419e0e4f603415afb58572738df19fb951ae704c4
SHA512f85e984492a24225cc3202a0160f5ed2b2a2a8bcbf87a62049f60ed286986ed741971bb45ced9226002051917b8ee85fe17a9861fbb8d3285abae3be686ae5d8