Analysis
-
max time kernel
2s -
max time network
3s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
10-12-2020 18:39
Static task
static1
Behavioral task
behavioral1
Sample
c81c2c539ccba4c38add72e271fe63a2e389f2f645050289257fc6af4f47a82e.bin.sample.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
c81c2c539ccba4c38add72e271fe63a2e389f2f645050289257fc6af4f47a82e.bin.sample.exe
Resource
win10v20201028
General
-
Target
c81c2c539ccba4c38add72e271fe63a2e389f2f645050289257fc6af4f47a82e.bin.sample.exe
-
Size
3.0MB
-
MD5
1441e78b9e6ce78dd02e7491b25e7f9e
-
SHA1
8c355fd0e062152a403cb0c42412850b60524aac
-
SHA256
c81c2c539ccba4c38add72e271fe63a2e389f2f645050289257fc6af4f47a82e
-
SHA512
52e34a8ea136783e2009700b330e7db32e817ab0420c77e6cf47ab79c385635036ac4b547d6d1ee7542eb1e2e0b88f741289b96bf66dde18f1fdd03cb554d023
Malware Config
Extracted
C:\$Recycle.Bin\INFECTION-HELP.txt
christopherlampar1990@tutanota.com
rodtherry1985@tutanota.com
lewisldupre@protonmail.com
http://corpleaks.net
http://hxt254aygrsziejn.onion
Signatures
-
Drops desktop.ini file(s) 1 IoCs
Processes:
c81c2c539ccba4c38add72e271fe63a2e389f2f645050289257fc6af4f47a82e.bin.sample.exedescription ioc process File opened for modification C:\$Recycle.Bin\S-1-5-21-3825035466-2522850611-591511364-1000\desktop.ini c81c2c539ccba4c38add72e271fe63a2e389f2f645050289257fc6af4f47a82e.bin.sample.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-3825035466-2522850611-591511364-1000\desktop.iniMD5
2695f9db0d05983718cb673b2d1a61e3
SHA1db942bf0fe4758fa9bd8f983ea6a03a88fbff174
SHA256c86d7f85acd1e03d25a41c01da21ed70c6dd089b5b697778d1500a68feebb7c5
SHA512019c125862a62db6abe3f41a8bd537a77dfacf27038123322a960af13ae77f2f5fa4c9808796447315873d78c232fb8faa0cc8fa40d046e9b668f7c89c7c6874
-
memory/1080-2-0x0000000000400000-0x0000000000745000-memory.dmpFilesize
3.3MB
-
memory/1080-3-0x0000000000400000-0x0000000000745000-memory.dmpFilesize
3.3MB
-
memory/1080-4-0x0000000000400000-0x0000000000745000-memory.dmpFilesize
3.3MB