Overview
overview
10Static
static
3INQUIRY 20...20.exe
windows7-x64
10INQUIRY 20...20.exe
windows10-2004-x64
7$APPDATA/s...DH.dll
windows7-x64
1$APPDATA/s...DH.dll
windows10-2004-x64
1$APPDATA/s...ui.dll
windows7-x64
1$APPDATA/s...ui.dll
windows10-2004-x64
1$APPDATA/s...sX.exe
windows7-x64
1$APPDATA/s...sX.exe
windows10-2004-x64
1$APPDATA/s...60.dll
windows7-x64
1$APPDATA/s...60.dll
windows10-2004-x64
1$APPDATA/s...cl.dll
windows7-x64
3$APPDATA/s...cl.dll
windows10-2004-x64
3$PLUGINSDI...sh.dll
windows7-x64
3$PLUGINSDI...sh.dll
windows10-2004-x64
3$TEMP/Barracoon.dll
windows7-x64
3$TEMP/Barracoon.dll
windows10-2004-x64
3$TEMP/alum...60.dll
windows7-x64
1$TEMP/alum...60.dll
windows10-2004-x64
1$TEMP/alum...xy.exe
windows7-x64
3$TEMP/alum...xy.exe
windows10-2004-x64
3$TEMP/alum...gP.dll
windows7-x64
3$TEMP/alum...gP.dll
windows10-2004-x64
3$TEMP/alum...ap.dll
windows7-x64
1$TEMP/alum...ap.dll
windows10-2004-x64
1$TEMP/map/...60.dll
windows7-x64
1$TEMP/map/...60.dll
windows10-2004-x64
1$TEMP/map/...ip.dll
windows7-x64
8$TEMP/map/...ip.dll
windows10-2004-x64
8$TEMP/refe...80.dll
windows7-x64
1$TEMP/refe...80.dll
windows10-2004-x64
1Analysis
- max time kernel
120s - max time network
124s - platform
windows7_x64 - resource
win7-20240708-en - resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system - submitted
27/08/2024, 04:29
Static task
static1
Behavioral task
behavioral1
Sample
INQUIRY 200609-07_06_2020.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral2
Sample
INQUIRY 200609-07_06_2020.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$APPDATA/simpleLogin/ear/AvVsPkDH.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral4
Sample
$APPDATA/simpleLogin/ear/AvVsPkDH.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$APPDATA/simpleLogin/ear/jbimpui.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral6
Sample
$APPDATA/simpleLogin/ear/jbimpui.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$APPDATA/simpleLogin/ear/resToResX.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral8
Sample
$APPDATA/simpleLogin/ear/resToResX.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$APPDATA/speakers/manifest/74.opends60.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral10
Sample
$APPDATA/speakers/manifest/74.opends60.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$APPDATA/speakers/manifest/edbgcl.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral12
Sample
$APPDATA/speakers/manifest/edbgcl.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$PLUGINSDIR/advsplash.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral14
Sample
$PLUGINSDIR/advsplash.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
$TEMP/Barracoon.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral16
Sample
$TEMP/Barracoon.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
$TEMP/alumni_reunions/calendars/retail/52.opends60.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral18
Sample
$TEMP/alumni_reunions/calendars/retail/52.opends60.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
$TEMP/alumni_reunions/calendars/retail/MicrosoftXslDebugProxy.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral20
Sample
$TEMP/alumni_reunions/calendars/retail/MicrosoftXslDebugProxy.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
$TEMP/alumni_reunions/calendars/retail/VsLogP.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral22
Sample
$TEMP/alumni_reunions/calendars/retail/VsLogP.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
$TEMP/alumni_reunions/calendars/retail/almap.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral24
Sample
$TEMP/alumni_reunions/calendars/retail/almap.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
$TEMP/map/clickheat/documents/74.opends60.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral26
Sample
$TEMP/map/clickheat/documents/74.opends60.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
$TEMP/map/clickheat/documents/msisip.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral28
Sample
$TEMP/map/clickheat/documents/msisip.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
$TEMP/referral/msvcrt80.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral30
Sample
$TEMP/referral/msvcrt80.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
General
- Target $APPDATA/simpleLogin/ear/resToResX.exe
- Size 38KB
- Sample240827-e4bsesvcpn
- SHA256 3a530aacf477d005147c3b3a782b96a7c9a8a17a0a3e163be255ca8a133ea430
- MD5 8952521941dbe005a4ac2fe8a88aba2c
- SHA1 b5114de8c2e78d72ec8ddb6ab7bcb02b1bb5291f
- SHA512 a79f7bd27370578be53e1ff46dbe52fc95c153c7213ad9ca5d2206c3d6e8ad315bb98058ad8d806aa33affc1c22c9784ba73b2e7da20b36dd77421f85a90d0ba
- SSDEEP 384:J1rc09Z2gN3uUXCKDWK93bZ3Jd0Oi9jqUOJesaxdu/+lW8wWhLCcMe/oTC4:H12jUXCH4rSqFCbU+17L3d/o+4
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2200 resToResX.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2200 resToResX.exe