abff8ad79e497aeb5787012b0b0b718324e98bff7e703071c9fe75d6e534b6d6

Submit
Reports

Overview

overview

Static

static

0486218577...d9.exe

windows7-x64

09bfd15145...11.exe

windows7-x64

141d93e2d4...aa.exe

windows7-x64

16c2807567...55.exe

windows7-x64

2f41c73046...95.exe

windows7-x64

3e275093a5...01.exe

windows7-x64

419a809f42...89.exe

windows7-x64

4b10fd0d5e...58.exe

windows7-x64

4d78c439ed...f7.exe

windows7-x64

4f7713dcf8...63.exe

windows7-x64

597deecbe6...4d.exe

windows7-x64

6b59edf464...e8.exe

windows7-x64

7def3cd43d...d8.exe

windows7-x64

96ba85326e...8a.exe

windows7-x64

97f1b6afb2...2e.exe

windows7-x64

9906747639...1e.exe

windows7-x64

9e1609ab7f...08.exe

windows7-x64

b7fc91fc1f...37.exe

windows7-x64

bf179bbd2c...25.exe

windows7-x64

cfc68c40f4...4f.exe

windows7-x64

e6e948a0aa...eb.exe

windows7-x64

f02fe52119...68.exe

windows7-x64

$PLUGINSDI...ec.dll

windows7-x64

$PLUGINSDI...ss.dll

windows7-x64

secrehosted.exe

windows7-x64

Resubmissions

27-11-2024 13:27

241127-qqdkmsvnhz 10

27-11-2024 09:28

241127-lfrx3atrgr 10

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-11-2024 13:27

Sharing

Copy URL

Twitter E-mail

Static task

static1

9 signatures

Behavioral task

behavioral1

Sample

04862185775476ae0b6f7e8a02133cb408d212ca17bbff5c20dcfdcf569b3dd9.exe

Resource

win7-20241010-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral2

Sample

09bfd15145c9d8e39f99d3dfe98337a8c488dc334dfe195d27bdeb5b2459fd11.exe

Resource

win7-20241023-en

discovery persistence ransomware spyware stealer

windows7-x64

16 signatures

150 seconds

Behavioral task

behavioral3

Sample

141d93e2d408738bba4f523f60d6ead702424e7d62c34921c8a34150a31870aa.exe

Resource

win7-20240903-en

dharma credential_access defense_evasion discovery execution impact persistence ransomware spyware stealer

windows7-x64

20 signatures

150 seconds

Behavioral task

behavioral4

Sample

16c2807567b31c30288d92c0649ce78ea87434104bac72db407bb45bf65a4855.exe

Resource

win7-20240903-en

discovery

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral5

Sample

2f41c73046f3b0f5edd79ae089b6b64ec3a0812ea02fe7325b8e5b171a621c95.exe

Resource

win7-20241023-en

jigsaw persistence ransomware spyware stealer

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral6

Sample

3e275093a5ad4b2083eda47dfd2e9053cae044f7990a323c6f649093a8d00901.exe

Resource

win7-20240903-en

xorist credential_access discovery macro macro_on_action persistence ransomware spyware stealer upx

windows7-x64

26 signatures

150 seconds

Behavioral task

behavioral7

Sample

419a809f42361b2fcff98eb6f201e54ecef532c9b378db06e999f54285032889.exe

Resource

win7-20241010-en

discovery

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral8

Sample

4b10fd0d5e4370dde456862f810e27b2be1f854356191b9893ab1a65f4af5358.exe

Resource

win7-20240903-en

emotet epoch2 banker discovery trojan

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral9

Sample

4d78c439ed8860a14aebcf79dfef27047a51fc36c514b40b48724cd9340ff6f7.exe

Resource

win7-20240903-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral10

Sample

4f7713dcf8ad6717ea6eb432774a29317649a512445221dc0a29ed79e48b7663.exe

Resource

win7-20241010-en

discovery

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral11

Sample

597deecbe673c67d998825bdf4ddeca83f6fbb3bdccec91dabf4f9052713ac4d.exe

Resource

win7-20240729-en

agilenet discovery spyware stealer

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral12

Sample

6b59edf464eaaeac4f4b2f43474e573694429f08c448db770618dc574b6171e8.exe

Resource

win7-20240903-en

evasion

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral13

Sample

7def3cd43d98a30a04f09be284cab8b8dbf96ecc2e78302f6c45ad524c41d7d8.exe

Resource

win7-20240708-en

spyware stealer

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral14

Sample

96ba85326e2250f4e1cf07f5981bb96ea1383901663a6354899b5da0cd77b98a.exe

Resource

win7-20241023-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral15

Sample

97f1b6afb24cda22203275fc34bd07ba51170729edba8ee67bdb66a529574a2e.exe

Resource

win7-20240903-en

discovery upx

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral16

Sample

9906747639b782d738555a2522acd4a09ca8a3356f7848a4e68f284d888d891e.exe

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral17

Sample

9e1609ab7f01b56a9476494d9b3bf5997380d466744b07ec5d9b20e416b10f08.exe

Resource

win7-20240903-en

mafiaware666 discovery ransomware

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral18

Sample

b7fc91fc1fa6a53b1e5d97e21a7abefbde3ca7349d4db0fdbe15ec2702b1b737.exe

Resource

win7-20240903-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral19

Sample

bf179bbd2ce7ca31e421334efa7d262e30dc16b9bb5cced1b8b18d119adc4425.exe

Resource

win7-20241010-en

discovery

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral20

Sample

cfc68c40f4631954894898633fd0c5a06c5ce5837eba7d4b56fc3514c01e124f.exe

Resource

win7-20240708-en

discovery

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral21

Sample

e6e948a0aa3605bbd636ccdfa56e771dfebafa1e150d84f96b1968f8803edbeb.exe

Resource

win7-20240903-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral22

Sample

f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe

Resource

win7-20240903-en

discovery evasion execution persistence

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral23

Sample

$PLUGINSDIR/nsExec.dll

Resource

win7-20240729-en

discovery

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral24

Sample

$PLUGINSDIR/nsProcess.dll

Resource

win7-20240903-en

discovery

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral25

Sample

secrehosted.exe

Resource

win7-20240903-en

discovery

windows7-x64

4 signatures

150 seconds

Report Analysis Logs

General

Target

e6e948a0aa3605bbd636ccdfa56e771dfebafa1e150d84f96b1968f8803edbeb.exe
Size

853KB
MD5

4df094b7a875e5d2e7cb634752cd951d
SHA1

c088d58529b77f6670891f9ebb7af80da830c9ce
SHA256

e6e948a0aa3605bbd636ccdfa56e771dfebafa1e150d84f96b1968f8803edbeb
SHA512

a932b3ca31cf5457d73f9d73429610c24fafd60e69ce849e0e3de7e4ab1ffe464ba40182d903b8f7dd7f80202587be81871d8a5dfec7a4da2d030eb67d63872e
SSDEEP

12288:Btu7UAD3Qlp2MtIaM2QVA2DrYrgMDvsu/UJHI20KoGIVlGiL:T+V3ap2pDsPvsu/UJHTkF

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2772	e6e948a0aa3605bbd636ccdfa56e771dfebafa1e150d84f96b1968f8803edbeb.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e6e948a0aa3605bbd636ccdfa56e771dfebafa1e150d84f96b1968f8803edbeb.exe
"C:\Users\Admin\AppData\Local\Temp\e6e948a0aa3605bbd636ccdfa56e771dfebafa1e150d84f96b1968f8803edbeb.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2772-0-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download