Analysis
-
max time kernel
111s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04-10-2024 13:01
Behavioral task
behavioral1
Sample
CLX.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
CLX.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
vWf��As.pyc
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral4
Sample
vWf��As.pyc
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
CLX.exe
-
Size
6.1MB
-
MD5
00dc9b79d26eb73e87c5f9435d7ce838
-
SHA1
60ce45cebf4dcd17a86173ca0ec2bf9315ce66d7
-
SHA256
01d803ec4d3146f20365d2527ea307e0d169b0f95323475c1d5280757c570751
-
SHA512
d7170998cdfaf5b515fb78248e3415ea9d25188ebd57aa74e79427481f4a09739b944a3dc2f4098718f743a31063d8b466ddaa9f3550c8b73832e4bb612db036
-
SSDEEP
98304:jgqWJCQ6amaHl3Ne4i3gZQSF2x+yAiWMJBYHR/szxcYMZybRorenGHxm98k6ntAz:j+LTeNtx+yAiWfR0FHpdotxs85nBa
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 268 CLX.exe -
resource yara_rule behavioral1/files/0x00040000000193a5-21.dat upx behavioral1/memory/268-23-0x000007FEF6780000-0x000007FEF6BEF000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2248 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2248 taskmgr.exe -
Suspicious use of FindShellTrayWindow 41 IoCs
pid Process 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe -
Suspicious use of SendNotifyMessage 40 IoCs
pid Process 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe 2248 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1840 wrote to memory of 268 1840 CLX.exe 29 PID 1840 wrote to memory of 268 1840 CLX.exe 29 PID 1840 wrote to memory of 268 1840 CLX.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\CLX.exe"C:\Users\Admin\AppData\Local\Temp\CLX.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\CLX.exe"C:\Users\Admin\AppData\Local\Temp\CLX.exe"2⤵
- Loads dropped DLL
PID:268
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2248
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵PID:2588
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5524803ed4bb517a735f6bc14faf68f0b
SHA188e81ff595883906d3926c1838ae2c99c6c8dd93
SHA25601cc48571b829447e13de958de42eb7e085290c313803d7e6c52ef1c4b3674c2
SHA51203833a8c3c2ed722684c7ca4e7764fdcb0164fbab11af3161e68feb5e23c93bb0b19eca8717f23f5e0a06a7ccb2b47f2bb42c562b42d1a707af3fa876b70a885