Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
13-05-2021 12:54
Static task
static1
Behavioral task
behavioral1
Sample
ed3cc6263d431f6da983641cfd09ca1d87e3ea319f254d36779cf827e3a2dd1f.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
ed3cc6263d431f6da983641cfd09ca1d87e3ea319f254d36779cf827e3a2dd1f.exe
Resource
win10v20210410
General
-
Target
ed3cc6263d431f6da983641cfd09ca1d87e3ea319f254d36779cf827e3a2dd1f.exe
-
Size
2.1MB
-
MD5
583cabc27c03b2be3095678112891d5e
-
SHA1
89800d941b3fd9ed51ddb92ebb4e745e47385c73
-
SHA256
ed3cc6263d431f6da983641cfd09ca1d87e3ea319f254d36779cf827e3a2dd1f
-
SHA512
49bcd0f6bd56592844f7dc4f0d6db66cdb477a99a7dce530a6a272b25aeb735393e1e4a974b03df72d773af1dabd2d50cee361e485e9ab3d9eaf8854123b76a4
Malware Config
Signatures
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
ed3cc6263d431f6da983641cfd09ca1d87e3ea319f254d36779cf827e3a2dd1f.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Wine ed3cc6263d431f6da983641cfd09ca1d87e3ea319f254d36779cf827e3a2dd1f.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
ed3cc6263d431f6da983641cfd09ca1d87e3ea319f254d36779cf827e3a2dd1f.exepid process 3016 ed3cc6263d431f6da983641cfd09ca1d87e3ea319f254d36779cf827e3a2dd1f.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
ed3cc6263d431f6da983641cfd09ca1d87e3ea319f254d36779cf827e3a2dd1f.exepid process 3016 ed3cc6263d431f6da983641cfd09ca1d87e3ea319f254d36779cf827e3a2dd1f.exe 3016 ed3cc6263d431f6da983641cfd09ca1d87e3ea319f254d36779cf827e3a2dd1f.exe 3016 ed3cc6263d431f6da983641cfd09ca1d87e3ea319f254d36779cf827e3a2dd1f.exe 3016 ed3cc6263d431f6da983641cfd09ca1d87e3ea319f254d36779cf827e3a2dd1f.exe 3016 ed3cc6263d431f6da983641cfd09ca1d87e3ea319f254d36779cf827e3a2dd1f.exe 3016 ed3cc6263d431f6da983641cfd09ca1d87e3ea319f254d36779cf827e3a2dd1f.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
ed3cc6263d431f6da983641cfd09ca1d87e3ea319f254d36779cf827e3a2dd1f.exedescription pid process target process PID 3016 wrote to memory of 3036 3016 ed3cc6263d431f6da983641cfd09ca1d87e3ea319f254d36779cf827e3a2dd1f.exe Explorer.EXE PID 3016 wrote to memory of 3036 3016 ed3cc6263d431f6da983641cfd09ca1d87e3ea319f254d36779cf827e3a2dd1f.exe Explorer.EXE PID 3016 wrote to memory of 3036 3016 ed3cc6263d431f6da983641cfd09ca1d87e3ea319f254d36779cf827e3a2dd1f.exe Explorer.EXE PID 3016 wrote to memory of 3036 3016 ed3cc6263d431f6da983641cfd09ca1d87e3ea319f254d36779cf827e3a2dd1f.exe Explorer.EXE PID 3016 wrote to memory of 3036 3016 ed3cc6263d431f6da983641cfd09ca1d87e3ea319f254d36779cf827e3a2dd1f.exe Explorer.EXE PID 3016 wrote to memory of 3036 3016 ed3cc6263d431f6da983641cfd09ca1d87e3ea319f254d36779cf827e3a2dd1f.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\ed3cc6263d431f6da983641cfd09ca1d87e3ea319f254d36779cf827e3a2dd1f.exe"C:\Users\Admin\AppData\Local\Temp\ed3cc6263d431f6da983641cfd09ca1d87e3ea319f254d36779cf827e3a2dd1f.exe"2⤵
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3016