Overview
overview
10Static
static
10ida.exe
windows7-x64
1ida.exe
windows10-2004-x64
1ida64.exe
windows7-x64
1ida64.exe
windows10-2004-x64
1idapyswitch.exe
windows7-x64
1idapyswitch.exe
windows10-2004-x64
1idat.exe
windows7-x64
1idat.exe
windows10-2004-x64
1idat64.exe
windows7-x64
1idat64.exe
windows10-2004-x64
1qwingraph.exe
windows7-x64
1qwingraph.exe
windows10-2004-x64
1Analysis
-
max time kernel
135s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2024 13:11
Behavioral task
behavioral1
Sample
ida.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
ida.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
ida64.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
ida64.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral5
Sample
idapyswitch.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
idapyswitch.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
idat.exe
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
idat.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
idat64.exe
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
idat64.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
qwingraph.exe
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
qwingraph.exe
Resource
win10v2004-20240709-en
General
-
Target
ida.exe
-
Size
4.0MB
-
MD5
9d6d3e344709427ab731813f88a739e1
-
SHA1
407f520ea5dbf4480fa331b72183b40c3ae76766
-
SHA256
016b7a713b52b20123ac3100ab0347daa2e6def4249dc6c5490f1ec2954ed4cc
-
SHA512
fb3d10e6745023d3a858e9dafb7701bf9c5cedacbfc5243a5ae885e7b5a2d3855a18c2565c7c35237e30f6479ca842ff3e9b68e964e03b7ea643100312548e43
-
SSDEEP
49152:p9EJ6ZQOajI9/7MlHrbh/MG7y72fl1cDQK0czmoPgqXfUnpzjfwRwaw5ArwuJyNa:RZt8HyG7g2fly9ljwCqDolZEKu1mD
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4892 ida.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 1356 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1356 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4892 ida.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ida.exe"C:\Users\Admin\AppData\Local\Temp\ida.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4892
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f8 0x4541⤵
- Suspicious use of AdjustPrivilegeToken
PID:1356