Analysis
-
max time kernel
156s -
max time network
90s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
24-05-2022 13:11
Static task
static1
Behavioral task
behavioral1
Sample
009a83236c600fd7ac034973f064284cec62f86631fe96e900cb664f86061431.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
009a83236c600fd7ac034973f064284cec62f86631fe96e900cb664f86061431.exe
Resource
win10v2004-20220414-en
General
-
Target
009a83236c600fd7ac034973f064284cec62f86631fe96e900cb664f86061431.exe
-
Size
190KB
-
MD5
2a4419024f501d168864771a38f85b8d
-
SHA1
760c1466a8692be40614a3a21c6b5897be764ef1
-
SHA256
009a83236c600fd7ac034973f064284cec62f86631fe96e900cb664f86061431
-
SHA512
7cf472e20a1235de2ef4f31950bd8decf5036b0f42917c54b38f6212287a38b4a2057044fb76b9150de3608f3147d14447a74d19fe8514b42cf0bf92f103fa6c
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
Processes:
009a83236c600fd7ac034973f064284cec62f86631fe96e900cb664f86061431.exedescription ioc process File created C:\Windows\SysWOW64\drivers\svchost.exe 009a83236c600fd7ac034973f064284cec62f86631fe96e900cb664f86061431.exe File opened for modification C:\Windows\SysWOW64\drivers\svchost.exe 009a83236c600fd7ac034973f064284cec62f86631fe96e900cb664f86061431.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 2720 svchost.exe -
Drops file in System32 directory 1 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\sLT.exf svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\009a83236c600fd7ac034973f064284cec62f86631fe96e900cb664f86061431.exe"C:\Users\Admin\AppData\Local\Temp\009a83236c600fd7ac034973f064284cec62f86631fe96e900cb664f86061431.exe"1⤵
- Drops file in Drivers directory
-
C:\Windows\SysWOW64\drivers\svchost.exeC:\Windows\SysWOW64\drivers\svchost.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\drivers\svchost.exeFilesize
163KB
MD59d0d6abcf578ee032902f8fafb2c63b5
SHA1251b97e633e73195a240d4887a5945f7c4b589dc
SHA256fc8b4d222bdc2a367a9814a85da8460dd5f4da3e305f268431e2eef7badcb67b
SHA5126aa9c184142d90640fd535150d080a3afa7641113f7097933998eb655c2fd233ba58947a641f3192a806b2ac303cf103396bfebd03f5a5a0009affd01c51e780
-
C:\Windows\SysWOW64\drivers\svchost.exeFilesize
155KB
MD587c7bda0fd32ef07a4ad1f15c17ae7ff
SHA1262b3f844d07d879467842f9f52da8507b1d400d
SHA256b2f3a82d6aaac7e0404c9f89ed57949395aa36b0e8a3f6a3e54ac0c315860aab
SHA5125ba5f599f6f694b4afe453b9645c2dad3e4efb88e5f174e0eb92b524fb3b740d0715d27835323aae40806407df2c0657181fb13b4df61810f1f44bba4426d6b2