Analysis
-
max time kernel
28s -
max time network
14s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17-09-2024 00:47
Behavioral task
behavioral1
Sample
Emerald X/Emerald.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
Emerald X/Emerald.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Emerald X/Injector.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
Emerald X/Injector.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
Emerald X/Injector.exe
-
Size
5.5MB
-
MD5
072bd8b0166f4e8c134fddd1a91b16c6
-
SHA1
da0e078b22b6739eb2ae67ef3dd7ac7ee841f96c
-
SHA256
f84e39b3be2ba74691b82dab25a4d42d13535f138d9c69ffe37d45d90612a34f
-
SHA512
5ff3173c47a7718c41076507a5c3d8e83021928dead3c82ce6e46b4609afa6ffa4af7cd4af1b779805c00ccd5b9ee5a59144c0507bb17db8fad77b0e144ee828
-
SSDEEP
49152:uACTPFe76hHoYwVbV+huHplzrvTAm+DGjV1ykc+nPsbn3+nM6Pzs0dn3dnndn+dF:WwHpoe6
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe 2840 Injector.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Emerald X\Injector.exe"C:\Users\Admin\AppData\Local\Temp\Emerald X\Injector.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2840
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3908,i,4356837537417149674,16553092232944545509,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:81⤵PID:3512