Analysis
-
max time kernel
142s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-06-2022 07:40
Static task
static1
Behavioral task
behavioral1
Sample
b7dfbb262541c2fadae34f13363f3d42329aabb380ae9d16021954569c4cb77e.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
b7dfbb262541c2fadae34f13363f3d42329aabb380ae9d16021954569c4cb77e.exe
-
Size
2.1MB
-
MD5
323a8aba0c38d245a7b05448c8d8ec43
-
SHA1
8246f104551fbd8cda34b3e05c4445d358ee3b48
-
SHA256
b7dfbb262541c2fadae34f13363f3d42329aabb380ae9d16021954569c4cb77e
-
SHA512
e882c9200446a4d6ed60bc96bc512daadcb2c80e6b819061e91f0b4ef1b529e5a6e393d34715b57ffb59dd014b6de359c6b68ca32add7ae4b9de440c69ec01f6
Malware Config
Signatures
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
b7dfbb262541c2fadae34f13363f3d42329aabb380ae9d16021954569c4cb77e.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Wine b7dfbb262541c2fadae34f13363f3d42329aabb380ae9d16021954569c4cb77e.exe -
Processes:
resource yara_rule behavioral2/memory/1180-130-0x0000000000400000-0x0000000000627000-memory.dmp themida behavioral2/memory/1180-132-0x0000000000400000-0x0000000000627000-memory.dmp themida -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2000 1180 WerFault.exe b7dfbb262541c2fadae34f13363f3d42329aabb380ae9d16021954569c4cb77e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7dfbb262541c2fadae34f13363f3d42329aabb380ae9d16021954569c4cb77e.exe"C:\Users\Admin\AppData\Local\Temp\b7dfbb262541c2fadae34f13363f3d42329aabb380ae9d16021954569c4cb77e.exe"1⤵
- Identifies Wine through registry keys
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 2882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1180 -ip 11801⤵