Overview
overview
7Static
static
1phish_aler...1).eml
windows10-2004-x64
3phish_aler...1).eml
windows11-21h2-x64
3C2_signatu...6e.png
windows10-2004-x64
1C2_signatu...6e.png
windows11-21h2-x64
C2_signatu...29.png
windows10-2004-x64
1C2_signatu...29.png
windows11-21h2-x64
C2_signatu...e7.png
windows10-2004-x64
1C2_signatu...e7.png
windows11-21h2-x64
C2_signatu...62.png
windows10-2004-x64
1C2_signatu...62.png
windows11-21h2-x64
C2_signatu...10.png
windows10-2004-x64
1C2_signatu...10.png
windows11-21h2-x64
email-html-1.html
windows10-2004-x64
3email-html-1.html
windows11-21h2-x64
7Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/05/2026, 00:02
Static task
static1
Behavioral task
behavioral1
Sample
phish_alert_sp2_2.0.0.0 (1).eml
Resource
win10v2004-20260130-en
Behavioral task
behavioral2
Sample
phish_alert_sp2_2.0.0.0 (1).eml
Resource
win11-20260130-en
Behavioral task
behavioral3
Sample
C2_signature_facebook_de641155-b458-42f0-a6a2-793aff344a6e.png
Resource
win10v2004-20260130-en
Behavioral task
behavioral4
Sample
C2_signature_facebook_de641155-b458-42f0-a6a2-793aff344a6e.png
Resource
win11-20260130-en
Behavioral task
behavioral5
Sample
C2_signature_instagram_71241da6-b9b2-4bdf-ab79-89222cc36529.png
Resource
win10v2004-20260130-en
Behavioral task
behavioral6
Sample
C2_signature_instagram_71241da6-b9b2-4bdf-ab79-89222cc36529.png
Resource
win11-20260130-en
Behavioral task
behavioral7
Sample
C2_signature_linkedin_35fc4abe-7d96-42f3-b57d-783e56c4aae7.png
Resource
win10v2004-20260130-en
Behavioral task
behavioral8
Sample
C2_signature_linkedin_35fc4abe-7d96-42f3-b57d-783e56c4aae7.png
Resource
win11-20260130-en
Behavioral task
behavioral9
Sample
C2_signature_swcmgiconlogo_2f69f945-29a8-4957-b32a-14d87a2c3062.png
Resource
win10v2004-20250619-en
Behavioral task
behavioral10
Sample
C2_signature_swcmgiconlogo_2f69f945-29a8-4957-b32a-14d87a2c3062.png
Resource
win11-20260130-en
Behavioral task
behavioral11
Sample
C2_signature_youtube_16bd8fcd-d70e-4b85-99b4-d1143ca5bf10.png
Resource
win10v2004-20260130-en
Behavioral task
behavioral12
Sample
C2_signature_youtube_16bd8fcd-d70e-4b85-99b4-d1143ca5bf10.png
Resource
win11-20260130-en
Behavioral task
behavioral13
Sample
email-html-1.html
Resource
win10v2004-20260130-en
Behavioral task
behavioral14
Sample
email-html-1.html
Resource
win11-20260130-en
General
- Target C2_signature_instagram_71241da6-b9b2-4bdf-ab79-89222cc36529.png
- Size 46KB
- Sample260507-ablppsgs4q
- SHA256 bf9a0a00b8d70320d162f7fa66238c579b909cb2b396ba9bd598924476d8ffac
- MD5 6d8e941c1b4cca26679aea3091df8a51
- SHA1 0f748090e0d4521e991c06b0d7d310c49ed7913d
- SHA512 a1d5915c34d9ed29f74db8c49f8d10c3106f144821a9e79fbdb34a1f21fa487346ca555f5e74a61970564afb7e5e92c90a4b92f880997a1c9c55ac42e017d613
- SSDEEP 768:Sc1wb2tKp8XY6fOCCv0qO9jlzyKhmgCksL/4K556EDjI8t+I5OXOZLadQf:Siwb2tKpSRCN2ldhm5xLwKLDsvW0+Ltf
- TLSH T1BB23F18978D3B603C094B97185BA5E839E27A0309C9033917F8FF0794B9DC59A9AB4C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3848 mspaint.exe 3848 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3848 mspaint.exe 3848 mspaint.exe 3848 mspaint.exe 3848 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\C2_signature_instagram_71241da6-b9b2-4bdf-ab79-89222cc36529.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3848
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:1204