Analysis
-
max time kernel
92s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
10-06-2022 12:31
Static task
static1
Behavioral task
behavioral1
Sample
28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa.exe
-
Size
364KB
-
MD5
cc7207f09a6fe41c71626ad4d3f127ce
-
SHA1
84e749c37978f9387e16fab29c7b1b291be93a63
-
SHA256
28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa
-
SHA512
c7f236f1bafa9192ba30f40b6cbc0e74c89a5b4d7ae95fa98d1ace3857849ba37d2211a2c42bb4f348bd218e1ce28a7006bbda07e3e1e51c09a806da17f9f655
Malware Config
Signatures
-
Detect WinDealer information stealer 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1808-130-0x0000000010000000-0x000000001003B000-memory.dmp family_windealer behavioral2/memory/1808-131-0x0000000010000000-0x000000001003B000-memory.dmp family_windealer -
suricata: ET MALWARE Win32/WinDealer CnC Activity (Checkin)
suricata: ET MALWARE Win32/WinDealer CnC Activity (Checkin)
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa.exepid Process 1808 28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa.exe 1808 28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa.exe"C:\Users\Admin\AppData\Local\Temp\28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa.exe"1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:1808