Analysis
- max time network
153s - platform
windows7_x64 - resource
win7-en - submitted
01/09/2021, 20:32
General
- Target a9296af40e2b6c379587350610af1e29.exe
- Size 3.3MB
- Sample210901-dpcm6drvx2
- SHA256 d3381a72eea9537847b33b164d5a9da0fe99be82fee18bdae6df3bc44443c6e8
Score
10/10
Malware Config
Signatures
- suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
- suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
- suricata: ET MALWARE Observed Win32/Ymacco.AA36 User-Agent
suricata: ET MALWARE Observed Win32/Ymacco.AA36 User-Agent
- suricata: ET MALWARE Win32/Tnega Activity (GET)
suricata: ET MALWARE Win32/Tnega Activity (GET)
- Downloads MZ/PE file
- Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.