Analysis
-
max time kernel
91s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
25-06-2022 05:01
Static task
static1
Behavioral task
behavioral1
Sample
76d441210eead01ad6fbe0fb4af433166bc35ae5df5a92421c8806fd0ed43e21.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
76d441210eead01ad6fbe0fb4af433166bc35ae5df5a92421c8806fd0ed43e21.exe
-
Size
709KB
-
MD5
3a447ca68e3ffd34434c01dd6e9ee962
-
SHA1
55e105afa0b48615ea4362945006c9bd79733125
-
SHA256
76d441210eead01ad6fbe0fb4af433166bc35ae5df5a92421c8806fd0ed43e21
-
SHA512
31c9cc9fdd958876e654a78afb6400b725fd9712c01e4f9122526c9c442b16078818c7e48fac761d97cc7f10edcf3abd3fd0f7871cb196dd105bf06df6e70305
Malware Config
Signatures
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
76d441210eead01ad6fbe0fb4af433166bc35ae5df5a92421c8806fd0ed43e21.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Wine 76d441210eead01ad6fbe0fb4af433166bc35ae5df5a92421c8806fd0ed43e21.exe -
Processes:
resource yara_rule behavioral2/memory/5048-130-0x0000000001000000-0x000000000117F000-memory.dmp themida behavioral2/memory/5048-131-0x0000000001000000-0x000000000117F000-memory.dmp themida -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1272 5048 WerFault.exe 76d441210eead01ad6fbe0fb4af433166bc35ae5df5a92421c8806fd0ed43e21.exe 2180 5048 WerFault.exe 76d441210eead01ad6fbe0fb4af433166bc35ae5df5a92421c8806fd0ed43e21.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\76d441210eead01ad6fbe0fb4af433166bc35ae5df5a92421c8806fd0ed43e21.exe"C:\Users\Admin\AppData\Local\Temp\76d441210eead01ad6fbe0fb4af433166bc35ae5df5a92421c8806fd0ed43e21.exe"1⤵
- Identifies Wine through registry keys
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 5682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 5642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5048 -ip 50481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5048 -ip 50481⤵