Analysis

  • max time kernel
    140s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05/09/2024, 15:56

General

  • Target

    XOutput.exe

  • Size

    2.2MB

  • MD5

    250844b8abb064b491296026467eeb71

  • SHA1

    def2c93459a4f5481139647095b3866be985e2e9

  • SHA256

    5768f80c72d36e90d3213614279c4ea0fe15abff28870bb64861aa42f90f6673

  • SHA512

    ec8702598b1c1891fd54274e2cd58ab247f816ef1bab5bb5969e066601df9cad6af089485ca08e7dcbab0ec3ca81825b0193356a1e1fe18e2c000483a1c022f1

  • SSDEEP

    24576:rRAPggD7PIEjR4xq7iiXTK7D3So9AIB+j3pSo2UXuwwpSDBsRhxA/bSInQivEHCn:kL70XWIB+jZkwwpSqRDA/+FOGCn

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\XOutput.exe
    "C:\Users\Admin\AppData\Local\Temp\XOutput.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:2516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\Costura\44B19228E411D572B12D7DA34982BC35\64\vigemclient.dll

    Filesize

    307KB

    MD5

    40e1edb55ec4db991440c45f723a14d6

    SHA1

    5797f1922984b684b73e2363d8573049237445e4

    SHA256

    966e579ad8224ca87ae78a8788c5eb0c33ecb932dcc6ca25c39871e20b97a15a

    SHA512

    c99e4016374203f29f75132afd5f42cecceb50a5b45a33bddb1bc60b4d3b196c6ebaa1dba12f8e1bff2c95bf83518a12bf25d659d634c5a33445445d8246e178

  • memory/2516-6-0x000007FEF59A0000-0x000007FEF638C000-memory.dmp

    Filesize

    9.9MB

  • memory/2516-2-0x000007FEF59A0000-0x000007FEF638C000-memory.dmp

    Filesize

    9.9MB

  • memory/2516-3-0x0000000000510000-0x000000000053C000-memory.dmp

    Filesize

    176KB

  • memory/2516-4-0x00000000023D0000-0x000000000241A000-memory.dmp

    Filesize

    296KB

  • memory/2516-5-0x0000000000560000-0x0000000000572000-memory.dmp

    Filesize

    72KB

  • memory/2516-0-0x000007FEF59A3000-0x000007FEF59A4000-memory.dmp

    Filesize

    4KB

  • memory/2516-7-0x0000000000540000-0x000000000054A000-memory.dmp

    Filesize

    40KB

  • memory/2516-8-0x000007FEF59A0000-0x000007FEF638C000-memory.dmp

    Filesize

    9.9MB

  • memory/2516-9-0x000000001CE10000-0x000000001CEBA000-memory.dmp

    Filesize

    680KB

  • memory/2516-10-0x000000001B6A0000-0x000000001B73A000-memory.dmp

    Filesize

    616KB

  • memory/2516-1-0x0000000000C80000-0x0000000000EB8000-memory.dmp

    Filesize

    2.2MB

  • memory/2516-15-0x000007FEF59A3000-0x000007FEF59A4000-memory.dmp

    Filesize

    4KB

  • memory/2516-16-0x000007FEF59A0000-0x000007FEF638C000-memory.dmp

    Filesize

    9.9MB