Analysis
-
max time kernel
146s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2024 00:02
Static task
static1
Behavioral task
behavioral1
Sample
RealTurb CAT Areas Global for MSFS/Doc/RealTurb CAT Areas Global for MSFS.pdf
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
RealTurb CAT Areas Global for MSFS/RealTurb CAT Areas Global for MSFS.exe
Resource
win10v2004-20240802-en
General
-
Target
RealTurb CAT Areas Global for MSFS/RealTurb CAT Areas Global for MSFS.exe
-
Size
390KB
-
MD5
3725f88fffa18ed6e9a61b825ecb6261
-
SHA1
b691030a9662cfbb3010ac688e7eb96f941470d9
-
SHA256
b846ffb808530ace39f180ed3e638b90622aead4b0dfb7d6485bff0787f0aa3e
-
SHA512
be4fb4467c3e3929af5e03da730131b102fad381d643e4dd78e74625b2aa22bfa5b1e8fc8863c5f96d6ba66be4a47c52759f6e0ed5605a994378aa3d58d18abb
-
SSDEEP
6144:IgjJyDyLcPBq56gx1idia86ilxHD1idia86ilxHm1idia86ilxH:DJwPBq51xwdcfPHDwdcfPHmwdcfPH
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2348 RealTurb CAT Areas Global for MSFS.exe 2348 RealTurb CAT Areas Global for MSFS.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2348 RealTurb CAT Areas Global for MSFS.exe 2348 RealTurb CAT Areas Global for MSFS.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2348 RealTurb CAT Areas Global for MSFS.exe 2348 RealTurb CAT Areas Global for MSFS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RealTurb CAT Areas Global for MSFS\RealTurb CAT Areas Global for MSFS.exe"C:\Users\Admin\AppData\Local\Temp\RealTurb CAT Areas Global for MSFS\RealTurb CAT Areas Global for MSFS.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2348