880638c92fa2c08cb06e39cb26c8f0800a31261d7f9ca87b1b0d56e01d0e5299

Analysis

max time kernel
152s
max time network
168s
platform
windows7_x64
resource
win7-20220414-en
submitted
21-05-2022 03:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

880638c92fa2c08cb06e39cb26c8f0800a31261d7f9ca87b1b0d56e01d0e5299.exe
Size

326KB
MD5

92b1ba5c910b6cfdfbc4695c0bacb8be
SHA1

8efd46ec55189a7a288a6bd3ed62cd614e37536e
SHA256

880638c92fa2c08cb06e39cb26c8f0800a31261d7f9ca87b1b0d56e01d0e5299
SHA512

dee25836d7ce620269d8cf230c0d1307bd2adf031428b447f3f00c3de1fef216f46e537660c2fb10784f1b24b83e7550f0577da14eaad1dcdba286215bf234d6

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

880638c92fa2c08cb06e39cb26c8f0800a31261d7f9ca87b1b0d56e01d0e5299.exe

pid process

1808 880638c92fa2c08cb06e39cb26c8f0800a31261d7f9ca87b1b0d56e01d0e5299.exe

flow	ioc
4	ip-api.com

pid	process
1808	880638c92fa2c08cb06e39cb26c8f0800a31261d7f9ca87b1b0d56e01d0e5299.exe

C:\Users\Admin\AppData\Local\Temp\880638c92fa2c08cb06e39cb26c8f0800a31261d7f9ca87b1b0d56e01d0e5299.exe
"C:\Users\Admin\AppData\Local\Temp\880638c92fa2c08cb06e39cb26c8f0800a31261d7f9ca87b1b0d56e01d0e5299.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1808

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1808-54-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download