Analysis
-
max time kernel
184s -
max time network
218s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
08/05/2022, 03:53 UTC
Behavioral task
behavioral1
Sample
6faa2f0a3deee3445cbe82da91f7cfbb029725002dcf9a23a2f5670f5fbff923.exe
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
6faa2f0a3deee3445cbe82da91f7cfbb029725002dcf9a23a2f5670f5fbff923.exe
Resource
win10v2004-20220414-en
0 signatures
0 seconds
General
-
Target
6faa2f0a3deee3445cbe82da91f7cfbb029725002dcf9a23a2f5670f5fbff923.exe
-
Size
711KB
-
MD5
009ea8b18446221d93108d742af3efc8
-
SHA1
1da585ea827ae791215253162f4c4958b8c3faf6
-
SHA256
6faa2f0a3deee3445cbe82da91f7cfbb029725002dcf9a23a2f5670f5fbff923
-
SHA512
8eaeb2c64dfca5d535fa83d661d8346b794af37da78dbcf74ae5622c9f798a22f8eded04788b6138f73241989831ae967cec2e3b7f8a785e99e6772a7cb4d900
Score
10/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 6faa2f0a3deee3445cbe82da91f7cfbb029725002dcf9a23a2f5670f5fbff923.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRLT.EXE = "C:\\Windows\\system32\\CSRLT.EXE" 6faa2f0a3deee3445cbe82da91f7cfbb029725002dcf9a23a2f5670f5fbff923.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 6faa2f0a3deee3445cbe82da91f7cfbb029725002dcf9a23a2f5670f5fbff923.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\MSBLT.EXE = "C:\\Windows\\MSBLT.EXE" 6faa2f0a3deee3445cbe82da91f7cfbb029725002dcf9a23a2f5670f5fbff923.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\CSRLT.EXE 6faa2f0a3deee3445cbe82da91f7cfbb029725002dcf9a23a2f5670f5fbff923.exe File opened for modification C:\Windows\SysWOW64\CSRLT.EXE 6faa2f0a3deee3445cbe82da91f7cfbb029725002dcf9a23a2f5670f5fbff923.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\MSBLT.EXE 6faa2f0a3deee3445cbe82da91f7cfbb029725002dcf9a23a2f5670f5fbff923.exe File opened for modification C:\Windows\MSBLT.EXE 6faa2f0a3deee3445cbe82da91f7cfbb029725002dcf9a23a2f5670f5fbff923.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6faa2f0a3deee3445cbe82da91f7cfbb029725002dcf9a23a2f5670f5fbff923.exe"C:\Users\Admin\AppData\Local\Temp\6faa2f0a3deee3445cbe82da91f7cfbb029725002dcf9a23a2f5670f5fbff923.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
PID:4108