Overview
overview
10Static
static
80x00010000...55.exe
windows7_x64
10x00010000...55.exe
windows10_x64
10x00010000...47.exe
windows7_x64
10x00010000...47.exe
windows10_x64
10x00010000...70.exe
windows7_x64
80x00010000...70.exe
windows10_x64
80x00010000...13.exe
windows7_x64
80x00010000...13.exe
windows10_x64
80x00020000...73.exe
windows7_x64
10x00020000...73.exe
windows10_x64
10x00020000...83.exe
windows7_x64
100x00020000...83.exe
windows10_x64
100x00020000...36.exe
windows7_x64
80x00020000...36.exe
windows10_x64
80x00020000...40.exe
windows7_x64
70x00020000...40.exe
windows10_x64
70x00030000...09.exe
windows7_x64
100x00030000...09.exe
windows10_x64
100x00030000...22.exe
windows7_x64
100x00030000...22.exe
windows10_x64
100x00030000...26.exe
windows7_x64
100x00030000...26.exe
windows10_x64
0x00030000...34.exe
windows7_x64
100x00030000...34.exe
windows10_x64
100x00030000...06.exe
windows7_x64
100x00030000...06.exe
windows10_x64
100x00030000...41.exe
windows7_x64
100x00030000...41.exe
windows10_x64
100x00030000...45.exe
windows7_x64
10x00030000...45.exe
windows10_x64
10x00030000...48.exe
windows7_x64
80x00030000...48.exe
windows10_x64
8Analysis
-
max time kernel
113s -
max time network
16s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
25-11-2020 10:45
Behavioral task
behavioral1
Sample
0x000100000001ab86-55.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
0x000100000001ab86-55.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
0x000100000001ab87-47.exe
Resource
win7v20201028
Behavioral task
behavioral4
Sample
0x000100000001ab87-47.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
0x000100000001ab9c-70.exe
Resource
win7v20201028
Behavioral task
behavioral6
Sample
0x000100000001ab9c-70.exe
Resource
win10v20201028
Behavioral task
behavioral7
Sample
0x000100000001ad02-313.exe
Resource
win7v20201028
Behavioral task
behavioral8
Sample
0x000100000001ad02-313.exe
Resource
win10v20201028
Behavioral task
behavioral9
Sample
0x000200000001aca8-173.exe
Resource
win7v20201028
Behavioral task
behavioral10
Sample
0x000200000001aca8-173.exe
Resource
win10v20201028
Behavioral task
behavioral11
Sample
0x000200000001acb5-183.exe
Resource
win7v20201028
Behavioral task
behavioral12
Sample
0x000200000001acb5-183.exe
Resource
win10v20201028
Behavioral task
behavioral13
Sample
0x000200000001acdf-236.exe
Resource
win7v20201028
Behavioral task
behavioral14
Sample
0x000200000001acdf-236.exe
Resource
win10v20201028
Behavioral task
behavioral15
Sample
0x000200000001ace9-240.exe
Resource
win7v20201028
Behavioral task
behavioral16
Sample
0x000200000001ace9-240.exe
Resource
win10v20201028
Behavioral task
behavioral17
Sample
0x000300000001a5a2-209.exe
Resource
win7v20201028
Behavioral task
behavioral18
Sample
0x000300000001a5a2-209.exe
Resource
win10v20201028
Behavioral task
behavioral19
Sample
0x000300000001ac90-122.exe
Resource
win7v20201028
Behavioral task
behavioral20
Sample
0x000300000001ac90-122.exe
Resource
win10v20201028
Behavioral task
behavioral21
Sample
0x000300000001ac99-126.exe
Resource
win7v20201028
Behavioral task
behavioral22
Sample
0x000300000001ac99-126.exe
Resource
win10v20201028
Behavioral task
behavioral23
Sample
0x000300000001ac9e-134.exe
Resource
win7v20201028
Behavioral task
behavioral24
Sample
0x000300000001ac9e-134.exe
Resource
win10v20201028
Behavioral task
behavioral25
Sample
0x000300000001ac9e-206.exe
Resource
win7v20201028
Behavioral task
behavioral26
Sample
0x000300000001ac9e-206.exe
Resource
win10v20201028
Behavioral task
behavioral27
Sample
0x000300000001ac9f-141.exe
Resource
win7v20201028
Behavioral task
behavioral28
Sample
0x000300000001ac9f-141.exe
Resource
win10v20201028
Behavioral task
behavioral29
Sample
0x000300000001acec-245.exe
Resource
win7v20201028
Behavioral task
behavioral30
Sample
0x000300000001acec-245.exe
Resource
win10v20201028
Behavioral task
behavioral31
Sample
0x000300000001aced-248.exe
Resource
win7v20201028
Behavioral task
behavioral32
Sample
0x000300000001aced-248.exe
Resource
win10v20201028
General
-
Target
0x000100000001ab9c-70.exe
-
Size
977KB
-
MD5
5c6684e8c2b678de9e2776c6b50ddd72
-
SHA1
7d255100d811de745e6ee908d1e0f8ba4ff21add
-
SHA256
bb5d2c07ce902c78227325bf5f336c04335874445fc0635a6b67ae5ba9d2fefc
-
SHA512
f627ca67610f9d5c137bdae8b3f8f6c08ff9162d12b3e30d3886c72aec047d34e31b5f0e17120dc99d71b0c316e43bb946fc5d40a9babec7229ce3a3c9292acb
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
0x000100000001ab9c-70.tmppid process 1912 0x000100000001ab9c-70.tmp -
Loads dropped DLL 1 IoCs
Processes:
0x000100000001ab9c-70.exepid process 1732 0x000100000001ab9c-70.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
0x000100000001ab9c-70.tmppid process 1912 0x000100000001ab9c-70.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
0x000100000001ab9c-70.exedescription pid process target process PID 1732 wrote to memory of 1912 1732 0x000100000001ab9c-70.exe 0x000100000001ab9c-70.tmp PID 1732 wrote to memory of 1912 1732 0x000100000001ab9c-70.exe 0x000100000001ab9c-70.tmp PID 1732 wrote to memory of 1912 1732 0x000100000001ab9c-70.exe 0x000100000001ab9c-70.tmp PID 1732 wrote to memory of 1912 1732 0x000100000001ab9c-70.exe 0x000100000001ab9c-70.tmp PID 1732 wrote to memory of 1912 1732 0x000100000001ab9c-70.exe 0x000100000001ab9c-70.tmp PID 1732 wrote to memory of 1912 1732 0x000100000001ab9c-70.exe 0x000100000001ab9c-70.tmp PID 1732 wrote to memory of 1912 1732 0x000100000001ab9c-70.exe 0x000100000001ab9c-70.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\0x000100000001ab9c-70.exe"C:\Users\Admin\AppData\Local\Temp\0x000100000001ab9c-70.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-NP8CK.tmp\0x000100000001ab9c-70.tmp"C:\Users\Admin\AppData\Local\Temp\is-NP8CK.tmp\0x000100000001ab9c-70.tmp" /SL5="$50152,748569,121344,C:\Users\Admin\AppData\Local\Temp\0x000100000001ab9c-70.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\is-NP8CK.tmp\0x000100000001ab9c-70.tmpMD5
1a8ac942e4c2302d349caaed9943360d
SHA1a08ce743c3d90a2b713db3e58e747e7a00a32590
SHA256db8341fc8e86f7b80fbe144aa9ceea3e3369b64dcd5998c5a7f186c304cfeb96
SHA512d65e4f9846bb6fba5a8b4f9409b2576af041dfa9b453800c298ec810bd27cfcf28d1933bc79893aa79323654ab4b85e321b03eaf17d67f0e19c79749751e4aab
-
\Users\Admin\AppData\Local\Temp\is-NP8CK.tmp\0x000100000001ab9c-70.tmpMD5
1a8ac942e4c2302d349caaed9943360d
SHA1a08ce743c3d90a2b713db3e58e747e7a00a32590
SHA256db8341fc8e86f7b80fbe144aa9ceea3e3369b64dcd5998c5a7f186c304cfeb96
SHA512d65e4f9846bb6fba5a8b4f9409b2576af041dfa9b453800c298ec810bd27cfcf28d1933bc79893aa79323654ab4b85e321b03eaf17d67f0e19c79749751e4aab
-
memory/1912-1-0x0000000000000000-mapping.dmp