Analysis
-
max time kernel
180s -
max time network
203s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12/10/2024, 02:03
General
-
Target
keymouseclicker_setup_v1.0.exe
-
Size
16.7MB
-
MD5
2aba74f10ab74dbdf67758ffcb0777c9
-
SHA1
9bd64522f03000579ad86ddd28d2c287c601f99d
-
SHA256
75d8656a5d15e60dfb2ff1d24dd311c981992be1f8443192df9984e0b9cd9690
-
SHA512
818702f136813c49988d66f863f37c6962c7a4875d5aaae28df5317526881412ebd035e1881c4e83cb74f7d1690f892eea6d9ae9fe544642a4906ef4d41aa6e8
-
SSDEEP
393216:zOBXQTb1DA2HWTQKEli2KtI9jTKr914hc6IMKT43s:CRQTb1E2HqQKkiF69jOahxSs3s
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 37 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\keymouseclicker_setup_v1.0.exe"C:\Users\Admin\AppData\Local\Temp\keymouseclicker_setup_v1.0.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-E0I40.tmp\keymouseclicker_setup_v1.0.tmp"C:\Users\Admin\AppData\Local\Temp\is-E0I40.tmp\keymouseclicker_setup_v1.0.tmp" /SL5="$A01FC,16674729,814592,C:\Users\Admin\AppData\Local\Temp\keymouseclicker_setup_v1.0.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\KeyMouseClicker\KeyMouseClicker.exe"C:\Program Files (x86)\KeyMouseClicker\KeyMouseClicker.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.5MB
MD59bd2f1ca980405d84eab86e1c94b12b6
SHA132a24b46b34e6b7912cf76c7a988576f3febcf18
SHA256e312e5159bee3500bec52ed84b4d9c7fea0c52fd6a4a8784fc9b835527fff4b7
SHA51244645b3b1795ddf1fd72cd79671f14b2926c5db3f5cdbb8969e60164a587edb632da1f9d1c9306a10605f816669f4e6963ebedf7e6811f45c5ba7bf8f730b874
-
Filesize
3.7MB
MD5e09e09eca3a69778edcb8663ac1acf06
SHA1f6b7d7a515416c3d11c9dded7b20286790f599f2
SHA256532ad0997a991fceea218e41aa59cdff7edf892fb440c37e11e3e5adb0441874
SHA51252d43348956393c961b13b59d58a87313ced36ca90e554e17c73fca3ae2649393e69fc933ff44d51a8d4db33c6e92389103a0f7a3358232cda2e9aceb9c3e2dc
-
Filesize
10.6MB
MD59b20e228aba89df19ff0eb17fac1fef9
SHA1628147895628044937fa5352f27f8f64b713ba0a
SHA256bbfb294db03e883a6c55ebe340894467df18bb92b9ea16ee093df842d02389bb
SHA51277e3ed98796b574b1497b2b3da611dc76eb4305ad40ba6693b990f3fc6a77bc63b244ed9b244fa370e8d85ada45e247efcdcee0766052283ec14ba7eeb9af786
-
Filesize
110KB
MD5c758f912879a363f187d79132b7a0f33
SHA1f93113b6d00da22170175d09fbd1e58a5618426f
SHA25678e11474259a078440dfca592e7de90efebe9aead7c4bc6691789f563be0cfc4
SHA51274816ebd17210c7e7bca1968777add182f140c4db68a6514fa233f08c16a890134be0e2d12215f1f30f8397ea1bf4163209c2eac760247a1a37b8ad2a4cbc648
-
Filesize
5.8MB
MD5c9ca3e5249dab8104509dee8ea5624db
SHA1aeb013cb86210545b8005203c8691b77b99b83c6
SHA2569bfe1cb53ce534630afad27c943414db4a4585a0a3d4b6fb8c7a579940224c63
SHA5120d3e54f674a75547f40d88d42d1bf618839e8d0c8e82ee214bf0e2bb358e066ed51dd8f49c602493734b937d02793c4d2606ebf2121034a2f39603bea10929de
-
Filesize
63KB
MD59fbcc411df620b25ecc1e5b4dce8dbab
SHA164c41af6334ffdbffe46338162d919e4eba4d796
SHA256a04d578ca311407e621d6c4e9ede57b5de5306a0b31b5e1d6a5f33a776a75a4e
SHA5125f7c82cec5506880c89f32f25c957755ad0557b8ed32ad83c5926ec33c30e82089c2dc03ee2fddda15334bfe52adcc3d8c6a633601df8b2ed0c62ba232942178
-
Filesize
47KB
MD50effcf10bf6885c3a1bece9e56fdf9f9
SHA1e708acbd18e8df1dd5e0cafd1b3d8e89bfa4e182
SHA2562c5d602275d7a55d287848b1d1defcca84de5017b2987fe18b8a596223db9022
SHA5129faa3a0aa0c3091b3a57b9d5b67688fd06fd8082e67a0e2e7a24c66c5bce781c3b77ac6ee2f3b2dac900accdbfa69b9e05bea162bd1fc7b6dc831b11e53ad2bf
-
Filesize
54KB
MD50ced10d9aa2ae9190edb1bc091d1d446
SHA10c3a4c2fbd8c181a87b6e6e25ed1cf1634d60568
SHA25686638d0c48176d84e4853840b1776305c68e4bec6d3fac87dca6e7616bc5d5dd
SHA512dc3088886831b30853387b6e23c27b768c24bf076b90478dec4d2dffaaaa0a140d005d8c26f42878f82e1c53076914de386fa1ce87c1c9b4d9524474e24d37ee
-
Filesize
46KB
MD50998b293476cb1fe04fec8b06708cb3e
SHA1b03dbd1e455f968d9a3cd9e297810ecd5122ba68
SHA256674fd71df55f61001b21a20a0408763f0c83cbb51e08a0705d8864637e4a406a
SHA51285d6759bdba115794309b6d1b9d8e69544faf97c29544f7996aad86a5f24527a95d8bb4d64617b27575fda404d58d53a0587dd9e9a7443cb7fc7361eb6500f11
-
Filesize
894KB
MD559ec8b0ee0fbff9832c00973569517e4
SHA170948f6fa286b93628d0f9b7b035ba497848f0a4
SHA256bfebbcccf5908c632f991c3a18fdf2413f502e8d048b6097c8ca8d42240a30f2
SHA512c9f7b192f7369af505917f364353515d597f44eb05bc330f7a5359a1585f27047f10842a115b24d0191af8a7eae94fc55a68e5ffd59a0fc94969ba95973e6f0f
-
Filesize
59KB
MD51c669f318791ec8cf2f6513cba1dff81
SHA1dcff722650e316edb655286cfbc071e06909e136
SHA2566da6063340370747bb00546f37567efeb2071dcf18c338f8c0d37425967f663f
SHA512ba7407c8619a70d9ee9676ac17f9fcce4e2befa8b78ae38ea9f38b6c4e65ba4e0541c9c363132b735d2d533097cb71e0fe1fbe511da898889cd49cf940ed3694
-
Filesize
105KB
MD51a04d6f6353689213ec3b8771e9a4ce2
SHA19d84fbf8b8f931af8c84183333bd58b20f90befa
SHA256f07e464535e0fa2b13e4c42d86a6d594822aa1d2d960c77da327f77544e7bb9d
SHA5121b986b23038283771046dc7f579200dc310c9e964fdd59bfb6d7fff6535f89de2088d70d1724704f34e3deb1b2bfa7aaaeca665f80179df331e2f36ccfa858cc
-
Filesize
120KB
MD5496dcf8821ffc12f476878775999a8f3
SHA16b89b8fdd7cd610c08e28c3a14b34f751580cffd
SHA256b59e103f8ec6c1190ded21eef27bea01579220909c3968eeec37d46d2ed39e80
SHA51207118f44b83d58f333bc4b853e9be66dffb3f7db8e65e0226975297bf5794ebdaa2c7a51ef84971faf4d4233a68a6b5e9ac02e737d16c0ac19a6cf65fad9443f
-
Filesize
7.4MB
MD5dee4e29ec851849819b0e9ede5cadc71
SHA1fa57d8dd744d45b4c1e1f7556106807f3f144744
SHA2562039cec6c68306c7bac01db5a035dd3401baab6ea5440a00232da08734999a86
SHA512db0e6ce144edfb313e21a5aad63bf33e9f52a4cec05e49086442b6a13359bbb6e555becc253726cc0837d384aeba5b35569ca6e43ea0dc41a55903cb90d4afab
-
Filesize
823KB
MD544fa0edfc5c33c4e8ddf5b367d0982a1
SHA141a26d453e90db10a26c02b2a25ed38eea8a8859
SHA2563269d9cbf0093737e3ea512c4834333dbb7b995f6bdc2900ccf1a23f3cfc4507
SHA512b3df6d9986b7d0e75b3e23d0430373f1e74aefc0a0d057bba333de55fcb78cac4d729e0c5fa8194ffba8defa1ad8f45e15bdc90d24ab0b1e80907f459cd3a82c
-
Filesize
138KB
MD508d39dc1c3674ac7970e831d9699b3dc
SHA10c4104862ac6e50741513fcd9a057d6a26e9be04
SHA25652b9d5e3e1b913e20001d404b3e39398bf412096cc7e66b2febf647a0fba2c17
SHA512b7c2ae81d2f5a95ee26449fc06690dba072de65867d9c49b55a67ebedba382219ad77c93ccd6f25114886fc6eeed7e7126ca563c4ad8b11d02511be79a6e7877
-
Filesize
7.4MB
MD5d02600fc52352470be67279a0b43da12
SHA1f36d79675dc475c49d2e2fd24467c40a0048d137
SHA2565b7cbfd4c658aa9187d35cbe7e5e8d847db1e06f88f23fc252f8f2a71c929084
SHA512b9b819c601b3b88b1c943ce71072b4e5f99e29ade22a089355da2a4830693716b1d9f13c356c0b2b2bb5292bca3f49a836706cd2fff353a52101c0c22072cd10
-
Filesize
1.8MB
MD517172a14d4ab38dc8bc6b54afb5aa858
SHA1f623a97513af4eb80ca631150941f6ea8ab3d971
SHA25602f71a415dc6fba33d29e1d3829ffdce351a7cea04ed1cce6e4246b035ec156a
SHA512e481a3a657945a36ad2590a80612fb367c79f3c48af8ea187d04469a3aa4f1c1194bcba0627881a657d2fcadd8ebef500eafb8ef5c0ca0db67793c34b94145e3
-
Filesize
58KB
MD5662f3014c2d9afe6dbf589ef277b514c
SHA11ba71a6369eb7e37776c5447d15c283ec14e0096
SHA256c741d80a4f2e2aac3e146b87b405aacb64b83e3df1782a778b7ab10a34469da9
SHA5120f30422b03c99e438d4b13473a5cc91f3ad62ff840d3615869c5a23582832e45de67ee94e84286042730505cbee8006e9e912f81ff1ef8fbff6e38a842559160
-
Filesize
106KB
MD5870fea4e961e2fbd00110d3783e529be
SHA1a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA25676fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA5120b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88
-
Filesize
31KB
MD5e0cc8c12f0b289ea87c436403bc357c1
SHA1e342a4a600ef9358b3072041e66f66096fae4da4
SHA2569517689d7d97816dee9e6c01ffd35844a3af6cde3ff98f3a709d52157b1abe03
SHA5124d93f23db10e8640cd33e860241e7ea6a533daf64c36c4184844e6cca7b9f4bd41db007164a549e30f5aa9f983345318ff02d72815d51271f38c2e8750df4d77
-
Filesize
37KB
MD5d86a9d75380fab7640bb950aeb05e50e
SHA11c61aaf9022cd1f09a959f7b2a65fb1372d187d7
SHA25668fba9dd89bfad35f8fd657b9af22a8aebda31bffda35058a7f5ae376136e89b
SHA51218437e64061221be411a1587f634b4b8efa60e661dbc35fd96a6d0e7eff812752de0ada755c01f286efefc47fb5f2daf07953b4cfc4119121b6bee7756c88d0f
-
Filesize
556KB
MD526559ca6d82ec502f0cab5308e0c204b
SHA180b9c86afb2ea463aed57f7a791a1158c26f51f4
SHA25687fb20510260dc025caa84b05730468b990b8a6884c8ef71abab3d631778c4c0
SHA512df2778a020c865c18ca3011c1b67c9534869dd3b2eb4dc935c3ba18321eaf0877022574e4f291e135578e43e0964673e9ecf3554a29ad85225824d13660a0a52
-
Filesize
26KB
MD5649fb5b169ee4b7a1cc0761e361b708f
SHA13711fc82e9d84fe3b617a4d3263d015b7af32f37
SHA256b47c6049a04840f15fd4112fd0beb5886cda46af2895f899134b79cf4a0307bb
SHA5127e1623042b4bd82a83a514f7377534ee1fa0fbc15dc1a5f25405fcf726cd73fb934f6fe150cf8264115c99b501fe59124ee5a7cdae7e14b916f95b43fa92a052
-
Filesize
184KB
MD545855d22c0422306a352316cd7c93e59
SHA1f166ed4d3fd41f2376ed15ff1f1f8a68a759497e
SHA2568fb639f25abe15b8d93150c132bbb49db91cb7e077426b67da5e0ba32dd3d102
SHA5129809043160dbb866c6638b96db38d15c65aef7a227668e270eb09c54c17eb04b5e4196bec7bda2ffaaea04c6c5858d8c3b0029a82640cbac690a455a0e5b5a9a
-
Filesize
218KB
MD5333320ce15e743ca1cfaa33b37a5e354
SHA10ca08c0f3e8311972508822aaf4f7b7de125cca0
SHA256a93ab768a91ac03ab5070707bfe0f1c576af3a2f4244ef41e4b90295f0fcd6ea
SHA512fd509d76c4cde07ffcfca5890e3b50b206211392ecc344ff5dc734afefcd11f3b8e5a1fa345d68c39da348a4730adaf64d20336bb0fb70c4637abc5c91fb3eec
-
Filesize
65KB
MD52ad3039bd03669f99e948f449d9f778b
SHA1dae8f661990c57adb171667b9206c8d84c50ecad
SHA256852b901e17022c437f8fc3039a5af2ee80c5d509c9ef5f512041af17c48fcd61
SHA5128ffeaa6cd491d7068f9176fd628002c84256802bd47a17742909f561ca1da6a2e7c600e17cd983063e8a93c2bbe9b981bd43e55443d28e32dfb504d7f1e120c0
-
Filesize
5.5MB
MD51fe47c83669491bf38a949253d7d960f
SHA1de5cc181c0e26cbcb31309fe00d9f2f5264d2b25
SHA2560a9f2c98f36ba8974a944127b5b7e90e638010e472f2eb6598fc55b1bda9e7ae
SHA51205cc6f00db128fbca02a14f60f86c049855f429013f65d91e14ea292d468bf9bfdeebc00ec2d54a9fb5715743a57ae3ab48a95037016240c02aabe4bfa1a2ff4
-
Filesize
5.5MB
MD582a57c9537deb7a04dce29debfa8ea41
SHA1bea031f59dbeae40f2eaf1d6d3f7a884c0fd553b
SHA256f9f9fb484e12a26ab1ee9082e9fc14956ce3266b7c8b4004b805166bebcb9661
SHA5125b4adc20eeb24f84240e911b2df11aa9e4babbd12659ce576ba2a10a2862b6c64b9330c013a047ee4e20bfdb652b4635679a676b73361aed2cec3f4c457479ad
-
Filesize
5.8MB
MD5bfa426fa7f466acb6a765d8ff7b4b3c8
SHA1287a191fa623b78fe230f4a68b042b198230ea43
SHA256a2149ecdddee81fd95883f65530a958013f904b01438194efe9b791a8e73b479
SHA512e3af34ae7b817ebd4d0701a12ade64eac715f33189e99b8779dc610a72a94c321ed1dfd5976dff7292980a4f977458a6a6b1f4af303c77ecfdb852a702c21998
-
Filesize
295KB
MD5cfe13eaba4aeaaf0f5100f519558b9fd
SHA17629c3b2d4fedaa7b935b97035ffd5d41b02efd7
SHA256b858b7a0e2df9adcdc6a226afb502ccb6b43b82e3e1cde39b53bd2b50446aad9
SHA5123ab81c33f043e123cf9372dbdd5c68dc30f826ec32a1a0a667fb8432af06e06a2a30c521dac0a63007facbf62773bfeb7f6505b7e084d27061a7c155ed1536cc
-
Filesize
30KB
MD5f7b37a4e81c99e613cb5dc6dafce0f06
SHA1d3441ad938c36fe2a08aa2dfbb2c12db151efa19
SHA256b15fa67b4de9ff4a147c9fcbdfa451ae4d2c4c3e15c8d7f72d4393001d22a697
SHA512a1162db21c5a89ce84d530ee2b5d5a701086d49c1cc0c43c6d1f591e845f681a32c8b9d6d53adac3ed24bdb0e0352502e750361dcbeec67d29880fa1d560700e
-
Filesize
1.1MB
MD52ab7e66dff1893fea6f124971221a2a9
SHA13be5864bc4176c552282f9da5fbd70cc1593eb02
SHA256a5db7900ecd5ea5ab1c06a8f94b2885f00dd2e1adf34bcb50c8a71691a97804f
SHA512985480fffcc7e1a25c0070f44492744c3820334a35b9a72b9147898395ab60c7a73ea8bbc761de5cc3b6f8799d07a96c2880a7b56953249230b05dd59a1390ad
-
Filesize
48KB
MD5bba9680bc310d8d25e97b12463196c92
SHA19a480c0cf9d377a4caedd4ea60e90fa79001f03a
SHA256e0b66601cc28ecb171c3d4b7ac690c667f47da6b6183bff80604c84c00d265ab
SHA5121575c786ac3324b17057255488da5f0bc13ad943ac9383656baf98db64d4ec6e453230de4cd26b535ce7e8b7d41a9f2d3f569a0eff5a84aeb1c2f9d6e3429739
-
Filesize
3.0MB
MD56a5e5d192d24e86ef8b88028d992bd5f
SHA1df775472feda315bc9c33bb2062d136c7988eff4
SHA2560a6df8313d982262bd805e3320b9bd07939c7b9823032442dc91458ba94cad1c
SHA512b40dd4153458d8c1bd43deac78a0d32a6fb38a0ade16a455375b0613e7b8eb68350e9c5afd5d291aa3cda9b2f007443214903d66d10717e5051e11bd222ad13c
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
728KB
-
Filesize
848KB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.5MB
-
Filesize
5.9MB
-
Filesize
10.6MB
-
Filesize
5.8MB
-
Filesize
3.7MB