Analysis
-
max time kernel
41s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
10-06-2022 12:31
Static task
static1
Behavioral task
behavioral1
Sample
4a9b37ca2f90bfa90b0b8db8cc80fe01d154ba88e3bc25b00a7f8ff6c509a76f.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
4a9b37ca2f90bfa90b0b8db8cc80fe01d154ba88e3bc25b00a7f8ff6c509a76f.exe
-
Size
364KB
-
MD5
e01b393e8897ed116ba9e0e87a4b1da1
-
SHA1
313b231491408bd107cecf0207868336f26d79ba
-
SHA256
4a9b37ca2f90bfa90b0b8db8cc80fe01d154ba88e3bc25b00a7f8ff6c509a76f
-
SHA512
1fd8bb4d50600654d05f0f1fafaeeb873f68fcb98d35f5527d2605eeff96bd00407fec5996d3f7149b9c385b176414e7e8557a83649285fa8666718bd3684751
Malware Config
Signatures
-
Detect WinDealer information stealer 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1372-55-0x0000000010000000-0x000000001003B000-memory.dmp family_windealer behavioral1/memory/1372-56-0x0000000010000000-0x000000001003B000-memory.dmp family_windealer -
suricata: ET MALWARE Win32/WinDealer CnC Activity (Checkin)
suricata: ET MALWARE Win32/WinDealer CnC Activity (Checkin)
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
4a9b37ca2f90bfa90b0b8db8cc80fe01d154ba88e3bc25b00a7f8ff6c509a76f.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 4a9b37ca2f90bfa90b0b8db8cc80fe01d154ba88e3bc25b00a7f8ff6c509a76f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 4a9b37ca2f90bfa90b0b8db8cc80fe01d154ba88e3bc25b00a7f8ff6c509a76f.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
4a9b37ca2f90bfa90b0b8db8cc80fe01d154ba88e3bc25b00a7f8ff6c509a76f.exepid Process 1372 4a9b37ca2f90bfa90b0b8db8cc80fe01d154ba88e3bc25b00a7f8ff6c509a76f.exe 1372 4a9b37ca2f90bfa90b0b8db8cc80fe01d154ba88e3bc25b00a7f8ff6c509a76f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a9b37ca2f90bfa90b0b8db8cc80fe01d154ba88e3bc25b00a7f8ff6c509a76f.exe"C:\Users\Admin\AppData\Local\Temp\4a9b37ca2f90bfa90b0b8db8cc80fe01d154ba88e3bc25b00a7f8ff6c509a76f.exe"1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:1372