Analysis
-
max time kernel
163s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
13-11-2024 20:09
General
-
Target
$PLUGINSDIR/app-64.7z
-
Size
82.3MB
-
MD5
cb1ba9cbec946e070330bf6b7ea9fcec
-
SHA1
7440ce7c460cc6e8bc485be748064cde35f0d178
-
SHA256
f3712d37b10e45146d0f2e60d7694e1e81339bff472dace653fc1d0b00089783
-
SHA512
0d31b8d2fe90ff4636a7eda96eac1809a1c88039781cb32c8d6d5b49e93f631287876f68694e238de07dfb23177526c75e369d3d4171ab24e96cfd28506556ae
-
SSDEEP
1572864:NJ39Kk9MaLcLAeydx32B8ceyIS7nqYdd6hIExeIg6q7BMn:Mk9MaLC//vP7nMxeIg6WMn
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 9 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zO419676E8\ReturnThief.exe"C:\Users\Admin\AppData\Local\Temp\7zO419676E8\ReturnThief.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\7zO419E2029\ReturnThief.exe"C:\Users\Admin\AppData\Local\Temp\7zO419E2029\ReturnThief.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\ReturnThief.exe"C:\Users\Admin\Desktop\ReturnThief.exe"1⤵
- Executes dropped EXE