Overview
overview
10Static
static
6D02D012970...94.exe
windows7-x64
1DBm0yQwt.exe.ViR.exe
windows7-x64
10ca6ec46ee9...52.apk
windows7-x64
3calc.exe
windows7-x64
7ccc71c83c8...B3.exe
windows7-x64
7ccc71c83c8...68.exe
windows7-x64
7cd2d085998...-0.dll
windows7-x64
8cdffb7e75b...ss.exe
windows7-x64
3cf7382c25a...c9.exe
windows7-x64
6cgi19-alpt...e_.exe
windows7-x64
7chrst.exe
windows7-x64
3ci05l2a.exe
windows7-x64
cl.exe
windows7-x64
7clean.exe
windows7-x64
3coinvault.exe
windows7-x64
9com_loader.exe
windows7-x64
3csrss.ex_.exe
windows7-x64
6d.exe
windows7-x64
3d0a5cfec8e...B3.exe
windows7-x64
7d0a5cfec8e...A6.exe
windows7-x64
7d2164cdbc9...FB.exe
windows7-x64
3d2164cdbc9...08.exe
windows7-x64
7d4439055d2..._1.dll
windows7-x64
3d54d2a216e...96.exe
windows7-x64
7d5f29750a8...c5.apk
windows7-x64
3d6c32b0146...4d.zip
windows7-x64
1d889734783...48.exe
windows7-x64
daaa72f48b...2d.exe
windows7-x64
9ddbf1840bf...e2.exe
windows7-x64
10de882c049b..._3.dll
windows7-x64
3decrypt.exe
windows7-x64
3decrypted.ex_.exe
windows7-x64
6Analysis
-
max time kernel
360s -
max time network
365s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 03:20
Behavioral task
behavioral1
Sample
D02D012970AA164CAD15C757D7E52994.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral2
Sample
DBm0yQwt.exe.ViR.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral3
Sample
ca6ec46ee9435a4745fd3a03267f051dc64540dd348f127bb33e9675dadd3d52.apk
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
calc.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral5
Sample
ccc71c83c8d9895ef0b375273f9f185dfac63ecd01775e2dc705afe4d48c95e2_Dumped_TDS=4F9911B3.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
ccc71c83c8d9895ef0b375273f9f185dfac63ecd01775e2dc705afe4d48c95e2_TDS=4FAD9768.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral7
Sample
cd2d085998a289134ffaf27fbdcbc8cb_api-ms-win-system-dispex-l1-1-0.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral8
Sample
cdffb7e75b20eeae4db75c9962c17b3be980a719f7597e8b11a747d72c975a36_not_packed_maybe_useless.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral9
Sample
cf7382c25a8bf0d904d51063ceb29fb70f630bc9.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral10
Sample
cgi19-alptsevs-h555.exe_.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral11
Sample
chrst.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
ci05l2a.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral13
Sample
cl.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral14
Sample
clean.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral15
Sample
coinvault.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
com_loader.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral17
Sample
csrss.ex_.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
d.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral19
Sample
d0a5cfec8e80622b3e194b5ee03e93d78c7ef3478bead6a039d213caaaa58523_Dumped_TDS=4F9911B3.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
d0a5cfec8e80622b3e194b5ee03e93d78c7ef3478bead6a039d213caaaa58523_TDS=4FA478A6.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral21
Sample
d2164cdbc9c78db0115f382a139ccd758f8a25ebfc5ab3e0034e7aef0fe0b6b4_Dumped_TDS=4FB252FB.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral22
Sample
d2164cdbc9c78db0115f382a139ccd758f8a25ebfc5ab3e0034e7aef0fe0b6b4_TDS=4FB30D08.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral23
Sample
d4439055d2d63e52ffc23c6d24d89194_86e510605f1ee068bdc1ae306312652a__1.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
d54d2a216e637bcd36e5217cfba98896.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral25
Sample
d5f29750a8cb158d9b89a1e02e8addc5e410d1ddc48e660589144ade47f794c5.apk
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral26
Sample
d6c32b0146f219bdcb5cf524ea9e0047d9b9bd0fd7c395d5b11cbc4c3298824d.zip
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral27
Sample
d889734783273b7158deeae6cf804a6be99c3a5353d94225a4dbe92caf3a3d48.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
daaa72f48bea498c5ac7ce9bc315e585ff11dad04d1eeb0d1b0ce33a28bedf2d.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral29
Sample
ddbf1840bf626da19d8f3467fe9e20e2.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral30
Sample
de882c049be133a950b6917562bb2313_583a76e23c1998307d702709dadbe103__3.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral31
Sample
decrypt.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
decrypted.ex_.exe
Resource
win7-20240708-en
windows7-x64
General
-
Target
d6c32b0146f219bdcb5cf524ea9e0047d9b9bd0fd7c395d5b11cbc4c3298824d.zip
-
Size
284KB
-
MD5
3751a4a1f68718405518d107a8bcc563
-
SHA1
c58fe7477c0a639e64bcf1a49df79dee58961a34
-
SHA256
d6c32b0146f219bdcb5cf524ea9e0047d9b9bd0fd7c395d5b11cbc4c3298824d
-
SHA512
8fa33e5682069baf48c0e85375a4151356e5917d63fbe62642c1dc9f33ce77881a359c2300e2d221bce297fbe7349a66b55cc47ff8502125b2a44c23d59e8dfd
-
SSDEEP
6144:ZcQu7L20QOPNMNYKEdf7Q0chT7WbK1xb5a:S20Q1YKMfE06ja
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3040 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 3040 7zFM.exe Token: 35 3040 7zFM.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3040 7zFM.exe
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\d6c32b0146f219bdcb5cf524ea9e0047d9b9bd0fd7c395d5b11cbc4c3298824d.zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3040