bdac9de853d9b77880dd0ad0e7498fdee8d437766c7a64d41172826446bdd82f

Analysis

max time kernel
150s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-02-2025 23:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ImGui-KeyAuth-Base.exe
Size

1.1MB
MD5

802425f5934f95005e12059201c8a730
SHA1

f967f815fb8f7a724c58f5cb881056ea9f1cdd04
SHA256

bdac9de853d9b77880dd0ad0e7498fdee8d437766c7a64d41172826446bdd82f
SHA512

2164525c059d997e2d7659f4c8d371b1d515145ca3aa14681ba8886947d606c41fd00788856d9876488fa6892f5f880ee2eca0a5c775ed7ff447dd4003db16d3
SSDEEP

24576:Mxm2gKGN10QR0t1QEQ7l5kuGKFzFTSpkPcnz:wm2wH6I7lFFTFcn

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2064	ImGui-KeyAuth-Base.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2328	2064	ImGui-KeyAuth-Base.exe	32
PID 2064 wrote to memory of 2328	2064	ImGui-KeyAuth-Base.exe	32
PID 2064 wrote to memory of 2328	2064	ImGui-KeyAuth-Base.exe	32
PID 2328 wrote to memory of 2336	2328	cmd.exe	33
PID 2328 wrote to memory of 2336	2328	cmd.exe	33
PID 2328 wrote to memory of 2336	2328	cmd.exe	33
PID 2328 wrote to memory of 1344	2328	cmd.exe	34
PID 2328 wrote to memory of 1344	2328	cmd.exe	34
PID 2328 wrote to memory of 1344	2328	cmd.exe	34
PID 2328 wrote to memory of 352	2328	cmd.exe	35
PID 2328 wrote to memory of 352	2328	cmd.exe	35
PID 2328 wrote to memory of 352	2328	cmd.exe	35
PID 2064 wrote to memory of 2632	2064	ImGui-KeyAuth-Base.exe	36
PID 2064 wrote to memory of 2632	2064	ImGui-KeyAuth-Base.exe	36
PID 2064 wrote to memory of 2632	2064	ImGui-KeyAuth-Base.exe	36
PID 2632 wrote to memory of 2264	2632	cmd.exe	37
PID 2632 wrote to memory of 2264	2632	cmd.exe	37
PID 2632 wrote to memory of 2264	2632	cmd.exe	37
PID 2064 wrote to memory of 1556	2064	ImGui-KeyAuth-Base.exe	39
PID 2064 wrote to memory of 1556	2064	ImGui-KeyAuth-Base.exe	39
PID 2064 wrote to memory of 1556	2064	ImGui-KeyAuth-Base.exe	39
PID 1556 wrote to memory of 2856	1556	cmd.exe	40
PID 1556 wrote to memory of 2856	1556	cmd.exe	40
PID 1556 wrote to memory of 2856	1556	cmd.exe	40
PID 1556 wrote to memory of 1944	1556	cmd.exe	41
PID 1556 wrote to memory of 1944	1556	cmd.exe	41
PID 1556 wrote to memory of 1944	1556	cmd.exe	41
PID 1556 wrote to memory of 2848	1556	cmd.exe	42
PID 1556 wrote to memory of 2848	1556	cmd.exe	42
PID 1556 wrote to memory of 2848	1556	cmd.exe	42

C:\Users\Admin\AppData\Local\Temp\ImGui-KeyAuth-Base.exe
"C:\Users\Admin\AppData\Local\Temp\ImGui-KeyAuth-Base.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\ImGui-KeyAuth-Base.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\ImGui-KeyAuth-Base.exe" MD5
    3⤵
    PID:2336
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:1344
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE CON COLS=105 LINES=32
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\system32\mode.com
    MODE CON COLS=105 LINES=32
    3⤵
    PID:2264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\ImGui-KeyAuth-Base.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1556
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\ImGui-KeyAuth-Base.exe" MD5
    3⤵
    PID:2856
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:1944
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:2848

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads