19eee98cc49f5044687c2898fd27c4260cdf4f7606de1a88ddc0046331af9322 | Triage

Analysis

max time kernel
7s
max time network
8s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 19:18

Sharing

Report Analysis Logs

General

Target

Recoil-Control-(x64).exe
Size

506KB
MD5

7548153582bf8e95b5ee451add6d73c0
SHA1

bd82def1ef6bca4c864e360ead9e79f73025518c
SHA256

19eee98cc49f5044687c2898fd27c4260cdf4f7606de1a88ddc0046331af9322
SHA512

c853c60440c38d85ebcd1ad9bc19efbe2ab62d9122550b82f3ed3677b3039b2c1dc8bff0ee98d0c900208bc2192723d97b06696b7c843da9d0abe388cab7f390
SSDEEP

12288:PkMBc77Pue+DU7BvolT8yFQna7QBtce0KKuloLMH:8hPue+D6vkRFlssebKuge

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3448-0-0x0000000140000000-0x0000000140157000-memory.dmp	upx

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3448	Recoil-Control-(x64).exe
3448	Recoil-Control-(x64).exe
3448	Recoil-Control-(x64).exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3448	Recoil-Control-(x64).exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3448	Recoil-Control-(x64).exe
3448	Recoil-Control-(x64).exe

C:\Users\Admin\AppData\Local\Temp\Recoil-Control-(x64).exe
"C:\Users\Admin\AppData\Local\Temp\Recoil-Control-(x64).exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3448-0-0x0000000140000000-0x0000000140157000-memory.dmp

Filesize
1.3MB

Download