Analysis
-
max time kernel
150s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
14-06-2022 23:08
General
-
Target
2c5266c1053b343bcbd38d7bbfbf4a3b0be3d40b8f57320bed91b5ac26dacf30.exe
-
Size
1.5MB
-
MD5
5ee1227e20fe723538b50b7025ee546e
-
SHA1
21bdb503540c936fe3d0e5a06b8505f8aaaf9f28
-
SHA256
2c5266c1053b343bcbd38d7bbfbf4a3b0be3d40b8f57320bed91b5ac26dacf30
-
SHA512
0804de2124b34e627541d2485670af87bafc3418b90546d252d6379d37059635b4fadb27c83f0eebaa50f001bcdac215f217d095ac8c1eded971dab753b89e08
Score
10/10
Malware Config
Signatures
-
suricata: ET MALWARE APT-C-23 Activity (GET)
suricata: ET MALWARE APT-C-23 Activity (GET)
-
suricata: ET MALWARE Legion Loader Activity Observed (suspira)
suricata: ET MALWARE Legion Loader Activity Observed (suspira)
-
suricata: ET MALWARE Possible Malicious Macro DL EXE Feb 2016
suricata: ET MALWARE Possible Malicious Macro DL EXE Feb 2016
-
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c5266c1053b343bcbd38d7bbfbf4a3b0be3d40b8f57320bed91b5ac26dacf30.exe"C:\Users\Admin\AppData\Local\Temp\2c5266c1053b343bcbd38d7bbfbf4a3b0be3d40b8f57320bed91b5ac26dacf30.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VMWare Tools registry key
- Suspicious behavior: EnumeratesProcesses