Analysis
-
max time kernel
91s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
10-06-2022 12:31
Static task
static1
Behavioral task
behavioral1
Sample
db034aeb3c72b75d955c02458ba2991c99033ada444ebed4e2a1ed4c9326c400.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
db034aeb3c72b75d955c02458ba2991c99033ada444ebed4e2a1ed4c9326c400.exe
-
Size
448KB
-
MD5
0c8663bf912ef4d69a1473597925feeb
-
SHA1
78294dfc4874b54c870b8daf7c43cfb5d8c211d0
-
SHA256
db034aeb3c72b75d955c02458ba2991c99033ada444ebed4e2a1ed4c9326c400
-
SHA512
9081b85c8225f09caff9f1fd5a720d2cd3833dbf069cbc948b86ba0a1cd69faacad61ae22dd6b2ee025c9a8719f2509dc4e22d418960af00a103b3f901ee0fb2
Malware Config
Signatures
-
Detect WinDealer information stealer 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1512-130-0x0000000010000000-0x000000001003B000-memory.dmp family_windealer behavioral2/memory/1512-131-0x0000000010000000-0x000000001003B000-memory.dmp family_windealer -
suricata: ET MALWARE Win32/WinDealer CnC Activity (Checkin)
suricata: ET MALWARE Win32/WinDealer CnC Activity (Checkin)
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
db034aeb3c72b75d955c02458ba2991c99033ada444ebed4e2a1ed4c9326c400.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString db034aeb3c72b75d955c02458ba2991c99033ada444ebed4e2a1ed4c9326c400.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 db034aeb3c72b75d955c02458ba2991c99033ada444ebed4e2a1ed4c9326c400.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
db034aeb3c72b75d955c02458ba2991c99033ada444ebed4e2a1ed4c9326c400.exepid Process 1512 db034aeb3c72b75d955c02458ba2991c99033ada444ebed4e2a1ed4c9326c400.exe 1512 db034aeb3c72b75d955c02458ba2991c99033ada444ebed4e2a1ed4c9326c400.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\db034aeb3c72b75d955c02458ba2991c99033ada444ebed4e2a1ed4c9326c400.exe"C:\Users\Admin\AppData\Local\Temp\db034aeb3c72b75d955c02458ba2991c99033ada444ebed4e2a1ed4c9326c400.exe"1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:1512