0dece9fdaaf9fca84d4ea64f94e789ee03a7a7e663d138327c662c4fc23aa2bb

Analysis

max time kernel
149s
max time network
154s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 20:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
03646964ec3cfb95b37ca1e940923579.exe
Size 665KB
Sample201109-z9saj8xtfa
SHA256 0dece9fdaaf9fca84d4ea64f94e789ee03a7a7e663d138327c662c4fc23aa2bb
MD5 03646964ec3cfb95b37ca1e940923579
SHA1 c49760f02f87ae3b5ec6bf0ae217a4583f7ecc8b
SHA512 83fdab0ac26d1c47826773e8fa80e1c346d36fa4c9b34e49c54ca6f80e8f9e19364345ee556fb6609bacba9ba519e3efb8b73e001b3cdecaa8c02278277401bc
MD5 SHA1 SHA512

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	03646964ec3cfb95b37ca1e940923579.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	03646964ec3cfb95b37ca1e940923579.exe

C:\Users\Admin\AppData\Local\Temp\03646964ec3cfb95b37ca1e940923579.exe
"C:\Users\Admin\AppData\Local\Temp\03646964ec3cfb95b37ca1e940923579.exe"
1⤵
- Checks processor information in registry
PID:4684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4684-0-0x0000000000776000-0x0000000000777000-memory.dmp

Download

memory/4684-1-0x0000000000870000-0x0000000000871000-memory.dmp