Overview

overview

10

Static

static

c737bfd872...5f.exe

windows7_x64

1

c737bfd872...5f.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    102s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    14-05-2022 13:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c737bfd872527544c14ec50c589d0ff5bc26f8d643bc4441d190efe872a5b05f.exe

  • Size

    1.0MB

  • MD5

    e6aac02b7e6d8b28796e2f674505d13e

  • SHA1

    d19fbc0b8fd75183bb50241875aa9fdf094da520

  • SHA256

    c737bfd872527544c14ec50c589d0ff5bc26f8d643bc4441d190efe872a5b05f

  • SHA512

    8658a4cfd2b775e55d980da424191dd2719831a4969a0ac95b8741ded41ac7666806710ed570684db3a9479be87ba6312c293e1d525be1a037c9c70501c1bae8

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c737bfd872527544c14ec50c589d0ff5bc26f8d643bc4441d190efe872a5b05f.exe
    "C:\Users\Admin\AppData\Local\Temp\c737bfd872527544c14ec50c589d0ff5bc26f8d643bc4441d190efe872a5b05f.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1636
    • C:\Users\Admin\AppData\Local\Temp\c737bfd872527544c14ec50c589d0ff5bc26f8d643bc4441d190efe872a5b05f.exe
      "C:\Users\Admin\AppData\Local\Temp\c737bfd872527544c14ec50c589d0ff5bc26f8d643bc4441d190efe872a5b05f.exe"
      2⤵
        PID:956
      • C:\Users\Admin\AppData\Local\Temp\c737bfd872527544c14ec50c589d0ff5bc26f8d643bc4441d190efe872a5b05f.exe
        "C:\Users\Admin\AppData\Local\Temp\c737bfd872527544c14ec50c589d0ff5bc26f8d643bc4441d190efe872a5b05f.exe"
        2⤵
          PID:1712
        • C:\Users\Admin\AppData\Local\Temp\c737bfd872527544c14ec50c589d0ff5bc26f8d643bc4441d190efe872a5b05f.exe
          "C:\Users\Admin\AppData\Local\Temp\c737bfd872527544c14ec50c589d0ff5bc26f8d643bc4441d190efe872a5b05f.exe"
          2⤵
            PID:1324
          • C:\Users\Admin\AppData\Local\Temp\c737bfd872527544c14ec50c589d0ff5bc26f8d643bc4441d190efe872a5b05f.exe
            "C:\Users\Admin\AppData\Local\Temp\c737bfd872527544c14ec50c589d0ff5bc26f8d643bc4441d190efe872a5b05f.exe"
            2⤵
              PID:1288
            • C:\Users\Admin\AppData\Local\Temp\c737bfd872527544c14ec50c589d0ff5bc26f8d643bc4441d190efe872a5b05f.exe
              "C:\Users\Admin\AppData\Local\Temp\c737bfd872527544c14ec50c589d0ff5bc26f8d643bc4441d190efe872a5b05f.exe"
              2⤵
                PID:1764

            Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/1636-54-0x0000000000310000-0x0000000000418000-memory.dmp
              Filesize

              1.0MB

              Download
            • memory/1636-55-0x0000000076171000-0x0000000076173000-memory.dmp
              Filesize

              8KB

              Download
            • memory/1636-56-0x0000000000300000-0x000000000030E000-memory.dmp
              Filesize

              56KB

              Download
            • memory/1636-57-0x0000000005C40000-0x0000000005CAA000-memory.dmp
              Filesize

              424KB

              Download
            • memory/1636-58-0x0000000000640000-0x0000000000646000-memory.dmp
              Filesize

              24KB

              Download
            • memory/1636-59-0x0000000000730000-0x000000000075A000-memory.dmp
              Filesize

              168KB

              Download