Analysis
-
max time kernel
81s -
max time network
82s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
11/09/2024, 08:47
Static task
static1
Behavioral task
behavioral1
Sample
CryptoObfuscator.exe
Resource
win10-20240404-en
General
-
Target
CryptoObfuscator.exe
-
Size
13.2MB
-
MD5
9b3604701295001c27febda4ede73773
-
SHA1
25ce96ee0ca0002f49b8541036568a20b1cd273d
-
SHA256
aec6c22c784989b03b7dc6c11e0bf6ab4d64e09f25823b60c1d62be551c223b4
-
SHA512
652eb8869fed99b32414e818a1be04786c003359ce6d425e56e0eb254fab0cc91b27278da2579c12300f26602e3b0d5ec3d0f905eb8adb58d6e98c57c817d2f1
-
SSDEEP
393216:RqaA3LtpfnVkUcmwH0hr528lRMCpYRG8:LA3Lnfnmgrs8lmAYG
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 380 CryptoObfuscator.exe -
Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 380 CryptoObfuscator.exe 380 CryptoObfuscator.exe 380 CryptoObfuscator.exe 380 CryptoObfuscator.exe 380 CryptoObfuscator.exe 380 CryptoObfuscator.exe 380 CryptoObfuscator.exe 380 CryptoObfuscator.exe 380 CryptoObfuscator.exe 380 CryptoObfuscator.exe 380 CryptoObfuscator.exe 380 CryptoObfuscator.exe 380 CryptoObfuscator.exe 380 CryptoObfuscator.exe 380 CryptoObfuscator.exe 380 CryptoObfuscator.exe 380 CryptoObfuscator.exe 380 CryptoObfuscator.exe 380 CryptoObfuscator.exe 380 CryptoObfuscator.exe 380 CryptoObfuscator.exe 380 CryptoObfuscator.exe 380 CryptoObfuscator.exe 380 CryptoObfuscator.exe 380 CryptoObfuscator.exe 380 CryptoObfuscator.exe 380 CryptoObfuscator.exe 380 CryptoObfuscator.exe 380 CryptoObfuscator.exe 380 CryptoObfuscator.exe 380 CryptoObfuscator.exe 380 CryptoObfuscator.exe 380 CryptoObfuscator.exe 380 CryptoObfuscator.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 380 CryptoObfuscator.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 380 CryptoObfuscator.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CryptoObfuscator.exe"C:\Users\Admin\AppData\Local\Temp\CryptoObfuscator.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:380
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4540
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD58b003c3f98f8d08968ac5d3c1cc90a60
SHA168f8d418638a81839a2ad665909916cda8efe625
SHA256d52a9c53f510237a194211aa3dc7d0f22f80fcc0593d9d77e0827ba6681b47e9
SHA512429e97c74b8e45a43d09618972f04ba46a8075867a631543eb7b7cbbb55a719cbe2e0412f3b63b989741e3807d733b2a6f3ecb735278adc5e734e18e297c4015