General
-
Target
22F93B97E4EE74C1AF48CBDCF878A983CBE2FBA7EEFC5.exe
-
Size
3.1MB
-
Sample
210629-rb4t8mnwns
-
MD5
52bbd67fdb23378f2ad43efb150abdc4
-
SHA1
9d138f1bf129473cb0d74c0d94ec8af2daa311c7
-
SHA256
22f93b97e4ee74c1af48cbdcf878a983cbe2fba7eefc5cd639814dc942cbaa8d
-
SHA512
7cf115c532466de78abd369ba202f738a3520f7c2b87c4847a8d8e59dc6e2c0d7cd9da1995d019690edd92b3ed154a9d659b7a6932c091e9c042192a66049755
Static task
static1
Behavioral task
behavioral1
Sample
22F93B97E4EE74C1AF48CBDCF878A983CBE2FBA7EEFC5.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
22F93B97E4EE74C1AF48CBDCF878A983CBE2FBA7EEFC5.exe
Resource
win10v20210410
Malware Config
Extracted
http://gamecardsy.com/ahmadtestupl/DefenderControl.exe
Extracted
http://gamecardsy.com/ahmadtestupl/DefenderKill.txt
Extracted
http://gamecardsy.com/ahmadtestupl/Defender.bat
Extracted
http://gamecardsy.com/ahmadtestupl/ff.ps1
Extracted
http://gamecardsy.com/ahmadtestupl/DefenderControl.txt
Targets
-
-
Target
22F93B97E4EE74C1AF48CBDCF878A983CBE2FBA7EEFC5.exe
-
Size
3.1MB
-
MD5
52bbd67fdb23378f2ad43efb150abdc4
-
SHA1
9d138f1bf129473cb0d74c0d94ec8af2daa311c7
-
SHA256
22f93b97e4ee74c1af48cbdcf878a983cbe2fba7eefc5cd639814dc942cbaa8d
-
SHA512
7cf115c532466de78abd369ba202f738a3520f7c2b87c4847a8d8e59dc6e2c0d7cd9da1995d019690edd92b3ed154a9d659b7a6932c091e9c042192a66049755
Score10/10-
Modifies security service
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-